WPvivid Backup & Migration: Unauthenticated Cryptographic Fail-Open to RCE

Threat Overview

A critical unauthenticated arbitrary file upload vulnerability in WPvivid Backup & Migration (wpvivid-backuprestore), a popular site migration and backup suite installed on hundreds of thousands of WordPress websites, enables remote attackers to execute arbitrary PHP code on vulnerable servers.

Tracked under CVE-2026-1357 (CVSS 9.8), the defect chains a cryptographic “fail-open” bug during RSA session key decryption with directory traversal in the backup receiver endpoint. Any site running versions up to and including 0.9.123 with an active auto-migration key is exposed to immediate, unauthenticated server takeover.

The Breakdown: How the Exploit Works

To transfer site archives between WordPress installations, WPvivid exposes an unauthenticated receiver hook (wpvivid_action=send_to_site). Legitimate transfers encrypt an AES session key using the destination site’s RSA public key, which the receiving server decrypts via openssl_private_decrypt() inside class-wpvivid-crypt.php.

In versions up to and including 0.9.123, when an attacker submits a malformed RSA key, openssl_private_decrypt() fails and returns boolean false. Instead of halting execution, the plugin passes false straight into the phpseclib AES cipher initializer, which silently coerces false into a predictable 16-byte string of null bytes.

Knowing the cipher is locked to a static null-byte key, an unauthenticated attacker encrypts a payload containing ../ path traversal sequences in the filename parameter, escaping the backup folder and writing an executable .php webshell directly into wp-content/uploads/.

The Operational Risk: What an Attacker Gains

• Unauthenticated Remote Code Execution: Attackers upload and execute arbitrary PHP scripts with full web-server user permissions in a single HTTP POST request.
• Complete Database & Backup Theft: Stored backup archives inside wp-content/wpvividbackups/—containing SQL dumps, customer records, and password hashes—are immediately accessible.
• Persistent Webshell Implantation: Because payloads land inside wp-content/uploads/, planted backdoors survive subsequent plugin updates or removal.
• Automated Botnet Scanning: Public proof-of-concept scripts and scanning templates actively probe WordPress sites for the send_to_site endpoint.

Our Take in Plain English

“Site migrations and backups are supposed to reduce operational risk, not create a front-door key for hackers. On WordPress, migration plugins work by opening public file-upload receivers right on your live server and relying on custom PHP cryptography to keep strangers out. When one missing error check turns encryption into a predictable all-zero key, anyone on the internet can upload a server script. In a modern pre-rendered edge architecture, staging and migrations happen across private cloud build pipelines—never by opening public file-upload endpoints on your live domain.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Exposes public HTTP endpoints capable of writing archives directly into live server directories, relying on plugin-level PHP cryptography to block unauthorized uploads.
• Modern Pre-Rendered Edge Architecture: Handles staging, environment promotion, and rollbacks through atomic edge deployments from version control, leaving zero file-receiver endpoints on the public server.

Immediate Action Items for WordPress Operators

1. Update WPvivid Immediately: Upgrade wpvivid-backuprestore to version 0.9.124 or higher across all environments.
2. Revoke Unused Migration Keys: Delete active tokens under WPvivid → Settings → Auto-Migration and deactivate the plugin once a migration is finished.
3. Audit Uploads for Rogue PHP: Scan wp-content/uploads/ for unexpected .php files and inspect access logs for POST requests containing wpvivid_action=send_to_site.
4. Rotate Compromised Secrets: If send_to_site exploitation is detected, treat all stored backup archives and wp-config.php credentials as compromised.