CVE-2024-13869

CVE-2024-13869 Migration,Backup, Staging – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft...

CVE-2025-5961

CVE-2025-5961 Migration, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration RCE Unauthenticated Arbitrary File Upload → Remote Code Execution...

CVE-2025-5961

🚨 Migration, Backup, Staging – WPvivid Backup & Migration 📈 This vulnerability affects a plugin with over700,000+ installs 📝 CVE Details CVE: CVE-2025-5961 CVSS: 7.2 High Published: July 3, 2025 🔍 Description The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 未认证任意文件上传 → RCE CVE-2026-1357 （CVSS 9.8 严重，CWE-434）的 PoC：WordPress 的 WPvivid Backup & Migration 插件中存在未认证的任意文件上传漏洞，可导致远程代码执行。已在 0.9.124 （变更集 3448386）中修复。由 Lucas Montes 通过 Wordfence 漏洞赏金计划报告。 root@kitploit: ███████╗ █████╗ ██╗ ██╗ ███╗ ███╗...

WordPress WPvivid Backup <0.9.76 - Local File Inclusion

WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server. id: CVE-2022-2863 info: name: WordPress...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

CVE-2020-36842

CVE-2020-36842 CVE-2020-36842 - WPvivid Plugin Arbitrary File Upload Vulnerability Overview CVE ID: CVE-2020-36842 Disclosure / Update Date: October 16, 2024 Affected Plugin: WPvivid - Migration, Backup, Staging Affected Versions: Up to and including 0.9.35 Vulnerability Type: Arbitrary File Uplo...

WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvividuploadimportfiles' function in all versions up to, and including, 0.9.116. id: CVE-2025-5961 info: name: WordPress WPvivid...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...

CVE-2026-1357

🧨 CVE-2026-1357 – WPvivid Null-Key Exploit Tool CVE-2026-1357.py Migration, Backup, Staging – WPvivid Backup & Migration ≤ 0.9.123 Vulnerability: Unauthenticated Arbitrary File Upload → Remote Code Execution CVE: CVE-2026-1357 – CVSS 9.8 Critical GitHub: https://github.com/Nxploited Telegram:...

CVE-2026-1357-Lab

CVE-2026-1357 — WPvivid Backup & Migration（漏洞版 vs 已修复版 Docker 实验环境） 仅限本地的 Docker 实验环境，用于对比 WPvivid Backup & Migration： 漏洞版本： 0.9.123 已修复版本： 0.9.124 专为学习实践而构建（实验环境搭建、验证、日志、笔记）。任何与 PoC 相关的内容均设计为仅在此实验环境的 localhost 上运行 。 安全与范围 请仅 在您自己的机器上运行（localhost + Docker 网络）。 请勿针对您不拥有或未经明确许可测试的真实站点/系统。...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC 发现者： Lucas Montes NiRoX 漏洞类型： 未认证任意文件上传导致远程代码执行（RCE） CVE ID： CVE-2026-1357 CVSS 评分： 严重（9.8） 状态： 已在 0.9.124 版本中修复 概述 本仓库包含对 WPvivid Backup & Migration WordPress 插件（版本 = 0.9.123）中一个严重漏洞的分析和概念验证（PoC）。 该漏洞允许未认证攻击者 向服务器上传任意文件（如 PHP 木马），从而立即实现远程代码执行（RCE）...

CVE-2026-1357

CVE-2026-1357 CVE-2026-1357 的实验室环境 1. 构建环境 sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone 仓库链接 wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip wpvivid-backuprestore.0.9.123.zip sudo docker-compose up -d 在...

CVE-2026-1357-POC

CVE-2026-1357 — WPvivid Backup & Migration RCE CVE 致谢： Lucas Montes NiRoX 工具作者： CyberTechAjju CVSS： 9.8（严重） | 受影响版本： ≤ 0.9.123 | 已修复版本： 0.9.124 ⚠️ 免责声明 仅用于授权安全测试 。未经授权访问系统属于违法行为。 概述 通过两个链式漏洞在 WPvivid Backup & Migration 中实现未认证 RCE： 1. 加密失败开放（Crypto Fail-Open） — opensslprivatedecrypt 在密钥错误时返回 false ...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration El plugin para WordPress Migration, Backup, Staging – WPvivid Backup & Migration es vulnerable a la Subida Arbitraria de Archivos sin Autenticación en versiones hasta la 0.9.123 inclusive. Esto se debe a un manejo inadecuado de errores en el proceso d...

CVE-2026-82194

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82194

WPvivid — Backup, Migration & Staging for WordPress, versions prior to 0.9.134 , fails to validate a user-supplied path before passing it to a file deletion routine . An authenticated user with administrator privileges can exploit this path traversal to delete arbitrary files on the server , incl...

CVE-2026-82194 WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...