WPvivid Backup & Migration Plugin Exposed to Severe RCE Vulnerability CVE-2026-1357
- Critical remote code execution flaw identified in WPvivid Backup & Migration
- Exploitation necessitates the activation of the “receive backup from another site” feature, limited to a 24-hour attack window
- Patch released with version 0.9.123 on January 28; immediate user upgrades advised
WPvivid Backup & Migration, a widely-utilized WordPress plugin boasting nearly one million installations, has been found to harbor a critical vulnerability enabling malicious actors to execute code remotely.
While the consequences may appear dire, certain constraints diminish the practicality of exploitation.
This plugin facilitates website backups, restores, and migrations across different domains or hosting environments. Its fundamental functionalities are available at no cost, with optional premium enhancements for advanced tasks. Currently, it is installed on over 900,000 sites, serving upwards of 20,000 customers.
Exploitation and Remediation
Security analysts from Defiant have identified deficiencies in error handling within the RSA decryption methodology, coupled with inadequate file path sanitization.
These flaws empower malicious entities to upload arbitrary files to the server without authentication, thereby culminating in remote code execution (RCE).
The vulnerability, designated as CVE-2026-1357, carries a severity rating of 9.8/10 (critical). It impacts all editions prior to 0.9.123, released on January 28.
Despite the critical nature of this flaw, exploiting it is not as straightforward as one might presume. Only instances where the “receive backup from another site” feature is enabled are at risk, a setting that is not activated by default.
Moreover, malicious actors are restricted to a mere 24-hour timeframe to stage their attacks, as the necessary keys for sending backup files from other sites become obsolete after one day.
Regrettably, the precise number of vulnerable installations among the 900,000 active users remains unknown.
The official WordPress plugin repository only discloses the total for version 0.9, lacking any further differentiation. Nonetheless, since the release of the patch on January 28, the plugin has been downloaded approximately 200,000 times.
Source link: Techradar.com.
