What is the CVSS score of CVE-2026-1357?

CVE-2026-1357 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2026-1357?

WordPress sites using the WPvivid Backup & Migration plugin (versions ≤0.9.123) face critical risk of unauthorized file upload attacks without authentication, potentially enabling complete site…

Is there a public PoC exploit available for CVE-2026-1357?

Yes, a public proof-of-concept exploit is available for CVE-2026-1357. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-1357?

Within 24 hours: disable or remove the WPvivid plugin immediately; audit logs for suspicious uploads and backup integrity. Within 7 days: implement compensating controls (WAF rules blocking plugin upload endpoints, network segmentation); begin vendor communication for patch timeline. Within 30 days: migrate to alternative backup solution or establish continuous monitoring until patch release.

PHP CVE-2026-1357

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-02-11 security@wordfence.com

WordPress PHP OpenSSL RCE Path Traversal

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 06:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.