WordPress Backup Plugin Vulnerability Exposes 800,000 Sites to Remote Code Execution Attacks

A critical vulnerability has been identified in the WPvivid Backup & Migration plugin, impacting over 800,000 WordPress websites through potential remote code execution (RCE) attacks.

The vulnerability, designated as CVE-2026-1357, has been assigned a CVSS score of 9.8. It allows unauthenticated attackers to upload arbitrary files and execute malicious PHP code. This issue affects all WPvivid Backup versions up to and including 0.9.123, resulting from improper error handling during the plugin’s RSA decryption process and insufficient file path sanitization.

Upon RSA decryption failure, the plugin incorrectly passes a false value to the AES cipher initialization routine, interpreted as a string of null bytes. This allows attackers to encrypt payloads using a predictable null-byte key. Additionally, the lack of proper sanitation for filenames from encrypted payloads enables directory traversal, allowing files to be written to publicly accessible locations.

The vulnerability was discovered and responsibly reported by Lucas Montes (NiRoX) through the Wordfence Bug Bounty Program. A bounty of $2,145 was awarded for this finding. The vendor addressed the issue by implementing an empty check for the $key value in the decrypt_message() function, ensuring decryption failures halt processing and introducing strict file extension validation.

Exploitation of this vulnerability could result in arbitrary file uploads and execution, leading to potential full site compromise. Site owners are advised to update to WPvivid Backup version 0.9.124 or later to mitigate this risk.

Wordfence issued a firewall rule on Jan 22, 2026, for Premium, Care, and Response customers, with free user protection scheduled for Feb 21, 2026. The WPvivid development team released the patched version, 0.9.124, on Jan 28, 2026, following a prompt response to the report.

Based on reporting by GBHackers.