WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvividuploadimportfiles' function in all versions up to, and including, 0.9.116. id: CVE-2025-5961 info: name: WordPress WPvivid...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC 発見者: Lucas Montes NiRoX 脆弱性: 認証不要の任意ファイルアップロードによるリモートコード実行（RCE） CVE ID: CVE-2026-1357 CVSS: Critical9.8 ステータス: バージョン 0.9.124 でパッチ適用済み 概要 このリポジトリには、WPvivid Backup & Migration WordPressプラグイン（バージョン = 0.9.123）における重大な脆弱性の分析と概念実証（PoC）が含まれています。...

CVE-2026-1357

CVE-2026-1357 CVE-2026-1357 のラボ環境 1. 環境の構築 sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone リポジトリのリンク wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip wpvivid-backuprestore.0.9.123.zip sudo docker-compose up -...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE WPvivid Backup & Migration における未認証リモートコード実行（RCE） 800%2C000-brightgreen?style=for-the-badge" alt="Installs" 800,000〜900,000以上の WordPress サイトに影響する重大な脆弱性 未認証での任意 PHP アップロード → サーバー完全侵害 🌩️ 概要 CVE-2026-1357 （CVSS 9.8 – Critical）は、Migration, Backup, Staging – WPvivid Backup &...

CVE-2026-1357

🧨 CVE-2026-1357 – WPvivid Null-Key エクスプロイトツール CVE-2026-1357.py 移行、バックアップ、ステージング – WPvivid Backup & Migration ≤ 0.9.123 脆弱性: 認証なし任意ファイルアップロード → リモートコード実行 CVE: CVE-2026-1357 – CVSS 9.8（クリティカル） GitHub: https://github.com/Nxploited Telegram: @KNxploited 🧬 このスクリプトの機能 CVE-2026-1357.py は、WPvivid の脆弱性を利用...

CVE-2025-5961

CVE-2025-5961 移行、バックアップ、ステージング – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever...

CVE-2025-5961

🚨 移行・バックアップ・ステージング – WPvivid Backup & Migration 📈 この脆弱性は、700,000以上のインストール数 を誇るプラグインに影響します 📝 CVE 詳細 CVE: CVE-2025-5961 CVSS: 7.2（高） 公開日: 2025年7月3日 🔍 説明 WordPress用プラグイン Migration, Backup, Staging – WPvivid Backup & Migration は、wpvividuploadimportfiles 関数におけるファイルタイプ検証の欠如により、任意のファイルアップロード...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 認証なし任意ファイルアップロード → RCE CVE-2026-1357 （CVSS 9.8 Critical、CWE-434）のPoC：WordPress用プラグインWPvivid Backup & Migrationにおける認証なしの任意ファイルアップロードにより、リモートコード実行（RCE）に至ります。0.9.124 （チェンジセット3448386）で修正済み。Wordfence Bug Bountyプログラムを通じてLucas Montes氏により報告されました。...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82193: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82194: External Control of File Name or Path

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

CVE-2026-82182 WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

CVE-2026-82182

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

CVE-2026-82182: Improper Neutralization of Special Elements used in an SQL Command

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

CVE-2026-19722

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

PT-2026-83524

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging versions prior to 0.9.133 Description The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a...

CVE-2026-19722: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...