The WPvivid Backup & Migration plugin for WordPress implements an authentication‑free file upload feature that is exposed through the wpvivid_action=send_to_site parameter. When a session key fails to decrypt, the decryption routine propagates a boolean false value to an AES cipher it initializes, and the cipher treats that as a string of null bytes. An attacker can encrypt a malicious payload with a predictable null‑byte key, upload it, and the plugin writes the file to disk without sanitizing directory traversal characters in the supplied filename. The result is the ability for an unauthenticated actor to place an executable PHP file in a publicly reachable location and execute arbitrary PHP code against the site, effectively compromising the entire WordPress installation.

All installations of the WPvivid Backup & Migration WordPress plugin running any version up to and including 0.9.123 are affected. The vulnerability is present in all releases of the plugin up to that point, regardless of the WordPress core version.

The CVSS score of 9.8 illustrates a critical severity, and an EPSS score of 22% indicates a relatively high likelihood of exploitation in the real world. Because authentication is not required and the attack can be performed from the public web interface, any site with this plugin enabled is directly vulnerable. The vulnerability is not currently listed in CISA’s KEV catalog, but the immediacy of the RCE risk warrants urgent remedial action. Exploiting the flaw requires only knowledge of the upload endpoint and ability to craft a compatible encrypted payload, conditions that are readily met by automated scanning tools or malicious actors.