If your website runs on WordPress, backups are non-negotiable. But this week, a popular backup and migration plugin—WPvivid Backup & Migration—made headlines for the wrong reason: a critical vulnerability that can allow attackers to upload malicious files and take over a website under certain conditions.
The good news: there’s a fix.
The bad news: sites that haven’t patched (or that recently used migration features) could be exposed.
This post explains what’s happening in plain English, who is actually at risk, and what you should do right now.
What happened?
Security researchers disclosed CVE-2026-1357, a critical (CVSS 9.8) vulnerability affecting the WPvivid Backup & Migration plugin. In affected versions, an attacker may be able to upload arbitrary files without authentication, which can lead to remote code execution (RCE)—a common path to full site compromise.
According to the NVD entry, the issue involves improper error handling in RSA decryption combined with insufficient path sanitization when writing uploaded files.
Affected versions: up to and including 0.9.123.
Who is actually at risk?
This is the most important nuance: not every WPvivid installation is equally exposed.
Multiple reports note that the highest-risk scenario requires the optional feature “receive backup from another site” to be enabled (often used during migrations). That setting is described as off by default, but it can be enabled temporarily during a site move.
There’s also mention of a limited exploitation window due to key validity (reported as about 24 hours), which may reduce opportunistic scanning risk—but it does not remove the urgency to patch.
Treat this as urgent if you:
Have WPvivid installed and your version is 0.9.123 or older, and/or
You’ve recently migrated a site and enabled “receive backup from another site”.
What attackers typically do with flaws like this
When an attacker can upload files to your server, they often try to:
- Drop a web shell/backdoor (so they can return later)
- Create a hidden admin user
- Inject spam/SEO redirects
- Modify site files to steal form submissions or payment data
- Use the server to send phishing emails or host malware
Wordfence explicitly warns that this class of flaw is typically leveraged for complete site takeover.
What to do now (10–20 minutes)
1) Check if WPvivid is installed
In your WordPress admin:
Plugins → Installed Plugins → search “WPvivid”
If it’s installed, note the version.
2) Update WPvivid immediately
Update to a fixed version (widely reported as 0.9.124 or later).
If you can’t update right now, disable WPvivid temporarily until you can patch.
3) Disable “receive backup from another site” if you don’t need it
If you see an option related to receiving backups/migration inbound, and you’re not actively using it: Disable it
Avoid leaving migration “receive” features enabled after a site move
4) Do a quick compromise check
Even if you’re patching now, it’s worth spending 5 minutes looking for “obvious” signs:
- Unexpected admin users (Users → All Users)
- Recently added plugins/themes you don’t recognize
- Strange new files in common directories:
- wp-content/uploads/
- backup directories created by plugins
- Unusual outgoing email spikes or Google Search Console warnings (if you use them)
If you’re hosted on cPanel or similar, also check:
- File Manager “Recently Modified”
- Access logs for suspicious POST requests (if available)
5) Rotate credentials if anything looks suspicious
If you see signs of compromise, rotate:
- WordPress admin passwords
- Hosting panel (cPanel/Plesk) password
- SFTP/SSH credentials
- Database user password
And restore from a known-good backup only after updating first.
Practical prevention (so this doesn’t happen again)
Even if you’re not affected by this exact issue, here’s the pattern worth remembering:
- Minimise plugins (every plugin is extra attack surface)
- Patch weekly (set a calendar reminder)
- Use a WAF (Cloudflare/WAF options, or security plugins—depends on your stack)
- Backups should be tested (a backup you can’t restore is not a backup)
- Least privilege for admin accounts (don’t use admin for daily work)
