CVE-2026-1357 Details

A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the WPvivid Backup & Migration plugin for WordPress, affecting versions through 0.9.123. The issue arises from improper error handling during the RSA decryption process, coupled with a lack of path sanitization for uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it incorrectly continues execution by passing a false value to the phpseclib library's AES cipher initialization. This false value is interpreted as a string of null bytes, enabling an attacker to encrypt a malicious payload with a predictable null-byte key. Furthermore, the plugin allows filenames from the decrypted payload without proper sanitization, creating a directory traversal vulnerability that can escape the protected backup directory. As a result, unauthenticated attackers can upload arbitrary PHP files to publicly accessible directories and execute them remotely using the wpvivid_action=send_to_site parameter.

Users are advised to update the WPvivid Backup & Migration plugin to version 0.9.124 or later.