CVE-2026-1357 is a critical vulnerability in the WPvivid Backup, Migration & Staging plugin for WordPress (versions up to 0.9.123). The issue arises from improper error handling during RSA decryption where failure to decrypt a session key results in passing a false value to the AES cipher initialization, which is treated as a predictable null-byte key. This allows attackers to encrypt malicious payloads. Additionally, the plugin does not sanitize filenames from the decrypted payload, permitting directory traversal attacks to escape the backup directory. Consequently, unauthenticated attackers can upload arbitrary PHP files to publicly accessible directories and execute remote code via the wpvivid_action=send_to_site parameter.

Successful exploitation allows unauthenticated attackers to upload arbitrary PHP files to the server, leading to remote code execution with the privileges of the web server. This compromises confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable or remove the vulnerable plugin version to prevent exploitation. Monitor the vendor's official channels for updates and apply patches promptly once released.