Exploit for CVE-2026-1357

## https://sploitus.com/exploit?id=2C02F36B-A29D-560B-9FA0-E1015E8772A1
# CVE-2026-1357 — WPvivid Backup & Migration (Vuln vs Patched Docker Lab)

Local-only Docker lab for comparing **WPvivid Backup & Migration**:

* **Vulnerable:** `0.9.123`
* **Patched:** `0.9.124`

Built for learning practice (lab setup, verification, logs, notes). Anything PoC-related is intended to run **only inside this lab on localhost**.

---

## Safety & scope

* Run this **only on your own machine** (localhost + Docker network).
* Do not target real sites/systems you don’t own or don’t have explicit permission to test.
* This repo is about a reproducible lab + verifiable artifacts (not an exploitation guide).

---

## Quick start

```bash
docker compose up -d
```

Open:

* Vuln: [http://localhost:8081](http://localhost:8081)
* Patched: [http://localhost:8082](http://localhost:8082)

Admin (auto-seeded):

* user: `admin`
* pass: `admin`

Reset everything:

```bash
docker compose down -v
```

---

## Verification

### Generate the WPvivid key (manual, via UI)

1. Login to `http://localhost:8081/wp-admin/` (or `:8082`)
2. Go to **WPvivid Backup → Settings → Key**
3. Generate a key

![main page](screenshots/admin_page.jpg)
![key](screenshots/generate_key.jpg)

---

## Screenshots

**Vulnerable:**
![vuln](screenshots/vuln.jpg)

**Patched:**
![patched](screenshots/patched.jpg)

---

## Credits / References

* NVD: [https://nvd.nist.gov/vuln/detail/CVE-2026-1357](https://nvd.nist.gov/vuln/detail/CVE-2026-1357)
* Original PoC reference: [https://github.com/LucasM0ntes/POC-CVE-2026-1357](https://github.com/LucasM0ntes/POC-CVE-2026-1357)

---

## Disclaimer

This repository is for defensive research, education, and reproducible verification in a controlled environment.
Do not use it against systems you don’t own or have permission to test.