Critical WPvivid Backup Plugin Flaw Exposes 800,000+ WordPress Sites to Remote Code Execution

A serious security vulnerability has been discovered in the WPvivid Backup & Migration plugin, placing more than 800,000 WordPress websites at potential risk of remote code execution.

The issue was identified through the Wordfence Bug Bounty Program and affects plugin versions up to 0.9.123. It has been assigned a critical CVSS score of 9.8 under CVE-2026-1357.

What’s the Risk?

The vulnerability allows unauthenticated attackers to upload malicious files to affected websites. In certain configurations, this can result in complete site compromise. Once a malicious file such as a web shell is uploaded and executed, attackers can gain full control over the WordPress environment.

The exploit is triggered using the wpvivid_action=send_to_site parameter, which is connected to the plugin’s backup transfer functionality.

Root Cause of the Vulnerability

The issue stems from improper encryption handling and a lack of validation checks during file uploads. When the plugin attempts to decrypt a session key using openssl_private_decrypt(), a failure returns a false value. Instead of stopping execution, the system continues processing.

That failed decryption is interpreted as null bytes by the AES encryption component (via phpseclib), creating a predictable encryption state. Attackers can use this predictability to craft malicious payloads that bypass security controls.

Additionally, uploaded files are written to the server without sufficient checks for file type, extension, or directory path. This opens the door for directory traversal attacks, allowing malicious PHP files to be placed in publicly accessible locations and executed.

When Are Sites Affected?

The vulnerability impacts sites that have enabled the plugin’s “receive key” feature for remote backup transfers. This feature is disabled by default and has a maximum expiration window of 24 hours.

However, given the plugin’s large active installation base, even a small number of misconfigured sites could represent significant exposure.

Technical Breakdown

The core issue lies within the send_to_site() function. The plugin decrypts incoming POST data using a site-specific private key. If decryption fails, the false result becomes the AES key, effectively defaulting to null bytes.

Attackers can exploit this predictable encryption behavior by sending carefully crafted, base64-encoded payloads via the wpvivid_content parameter.

The decrypt_message() method does not properly verify whether decryption succeeded before proceeding. At the same time, uploaded files are not validated for safe extensions or restricted paths, allowing malicious scripts to be stored outside the intended backup directory.

Recommended Actions

• Immediately update the WPvivid Backup & Migration plugin to the latest patched version.
• Verify whether the “receive key” feature is enabled and disable it if not required.
• Review recent uploads and server logs for suspicious activity.
• Implement server-level restrictions to prevent PHP execution in upload directories.

Given the critical severity rating and the plugin’s widespread usage, prompt action is strongly advised for all affected site owners.

Author Bio – Sandeep Dharak

Sandeep Dharak is an SEO professional and technical content strategist specialising in WordPress optimisation, website architecture, and organic search performance. He works with brands to improve visibility through structured content planning, technical SEO audits, and data-driven growth strategies. He is associated with WPGrowthLab and AuthorityTrends, where he focuses on search strategy, technical analysis, and sustainable organic acquisition. His work regularly involves reviewing WordPress updates, plugin vulnerabilities, and evolving search engine guidelines to help businesses maintain secure and high-performing websites. Sandeep’s approach combines practical implementation with research-backed insights, ensuring that recommendations are both technically sound and aligned with long-term search performance goals.

AI Content Disclaimer This article was created with the assistance of AI tools to support research structuring and content drafting. All technical details, security references, and factual information have been reviewed and verified for accuracy before publication. The content is intended for informational purposes only and should not be considered legal, security, or professional advice. Website owners are encouraged to consult qualified security professionals or developers before implementing technical changes.