A critical vulnerability in the WPvivid Backup & Migration plugin could let attackers run code on affected WordPress sites without logging in. The plugin is installed on more than 900,000 websites, but exposure depends on a particular backup-transfer setting being enabled. A patched release is available, and administrators are urged to check their installations and update promptly.
Key takeaways
- The reported flaw affects WPvivid Backup & Migration versions up to 0.9.123.
- Sites with “receive backup from another site” enabled face the stated risk.
- Version 0.9.124 includes a fix; administrators should update as soon as possible.
A quick plugin check can help reduce exposure, but it is also a reminder to keep WordPress maintenance on a regular schedule.
What the vulnerability could allow
The flaw, identified as CVE-2026-1357 and rated 9.8 in severity, is linked to how the plugin handles errors and uploaded files. According to the report, an unauthenticated attacker could upload a malicious PHP file on a vulnerable site and potentially execute code on its server. That could lead to a site takeover or other serious compromise.
The issue does not affect every installation in the same way. The reported risk applies when the plugin’s option for receiving backups from another site is switched on—a feature used for backup transfers and migrations. Administrators should check whether it is enabled, but should not rely on disabling it as a substitute for installing the fix.
Update the plugin and review your setup
The developers have released version 0.9.124. The update is reported to improve error handling and filename checks, and to limit uploads to recognised backup formats. Site owners should update through their usual WordPress process and confirm that the installed version is no older than the fixed release.
After updating, review the plugin’s settings and remove extensions you no longer use. If you manage several sites, check each one rather than assuming they share the same version or configuration. Keep a current backup before making maintenance changes, and verify that the site remains functional afterwards.
Why ongoing WordPress maintenance matters
Plugins are a common source of security risk because a flaw in a widely used extension can affect many websites at once. Timely updates, routine checks of themes and plugins, and dependable backups can reduce the chance that a vulnerability turns into a prolonged outage or data loss.
A WordPress maintenance plan or care plan can help make those checks part of a consistent routine, particularly for owners who do not have time to monitor every update themselves. No plan can guarantee that a site will never be compromised, but prompt patching and regular oversight are practical ways to strengthen its defences.