{"id":210,"date":"2026-02-11T16:38:50","date_gmt":"2026-02-11T15:38:50","guid":{"rendered":"https:\/\/helloblog.io\/et\/wpvivid-backup-suvalise-faili-uleslaadimine-cve-2026-1357\/"},"modified":"2026-02-11T16:38:50","modified_gmt":"2026-02-11T15:38:50","slug":"wpvivid-backup-suvalise-faili-uleslaadimine-cve-2026-1357","status":"publish","type":"post","link":"https:\/\/helloblog.io\/et\/wpvivid-backup-suvalise-faili-uleslaadimine-cve-2026-1357\/","title":{"rendered":"WPvivid Backup pistikprogrammis avastati kriitiline suvalise faili \u00fcleslaadimise auk (CVE-2026-1357) &#8211; ohus on v\u00f5tmega \u201esend to site\u201d kasutajad"},"content":{"rendered":"\n<p>WordPressi varundus- ja migreerimispistikud on ebamugavalt k\u00f5rge v\u00e4\u00e4rtusega sihtm\u00e4rk: neil on ligip\u00e4\u00e4s failis\u00fcsteemile, tihti ka andmebaasile, ning varukoopiate liigutamine t\u00e4hendab paratamatult \u00fcleslaadimist\/alla\u00adlaadimist. 2026. aasta jaanuaris raporteeriti WPvivid Backup &#038; Migrationi (WordPress.org slug <code>wpvivid-backuprestore<\/code>, \u00fcle 800 000 aktiivse paigalduse) kohta kriitiline haavatavus, mis v\u00f5imaldab teatud seadistuse korral autentimata suvaliste failide \u00fcleslaadimist ja seel\u00e4bi kaugkoodi k\u00e4ivitamist (Remote Code Execution, RCE).<\/p>\n\n\n\n<p>Oluline t\u00e4psustus: r\u00fcnne muutub kriitiliseks ainult nendele saitidele, kus WPvividis on seadistatud funktsioon, mis lubab teisel saidil saata varukoopia sinu saidile (st pistikprogrammis on <em>genereeritud v\u00f5ti<\/em>). See funktsioon on vaikimisi v\u00e4lja l\u00fclitatud ning v\u00f5tme aegumine on seadistatav maksimaalselt 24 tunni peale.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kiire kokkuv\u00f5te: mida t\u00e4pselt parandada?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Kui kasutad WPvivid Backup &#038; Migrationit, uuenda kohe versioonile <strong>0.9.124<\/strong> (v\u00f5i uuemale).<\/li>\n\n\n<li>Kui sul on sisse l\u00fclitatud \u201ereceive backup from another site\u201d\/\u201esend to site\u201d stiilis funktsioon ja loodud API-v\u00f5ti, k\u00e4sitle olukorda kui <em>k\u00f5rgeimat prioriteeti<\/em>.<\/li>\n\n\n<li>Kui kasutad Wordfence\u2019i: Premium\/Care\/Response saidid said kaitsvad tulem\u00fc\u00fcrireeglid <strong>22.01.2026<\/strong>, Wordfence Free puhul j\u00f5uab sama kaitse <strong>21.02.2026<\/strong> (30 p\u00e4eva hiljem).<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Haavatavuse kokkuv\u00f5te (Wordfence Intelligence andmetel)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Nimi: <strong>Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload<\/strong><\/li>\n\n\n<li>CVSS: <strong>9.8 (Critical)<\/strong><\/li>\n\n\n<li>CVE: <strong>CVE-2026-1357<\/strong><\/li>\n\n\n<li>M\u00f5jutatud versioonid: <strong><= 0.9.123<\/strong><\/li>\n\n\n<li>Parandatud versioon: <strong>0.9.124<\/strong><\/li>\n\n\n<li>M\u00f5jutatud tarkvara: <strong>Migration, Backup, Staging &#8211; WPvivid Backup &#038; Migration<\/strong><\/li>\n\n\n<li>Plugin slug: <strong>wpvivid-backuprestore<\/strong><\/li>\n\n\n<li>Leidja: <strong>Lucas Montes (NiRoX)<\/strong> (raporteeritud Wordfence Bug Bounty Program kaudu)<\/li>\n\n\n<li>Bounty: <strong>$2,145.00<\/strong><\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Miks see auk on ohtlik: autentimata fail upload \u2192 RCE \u2192 t\u00e4ielik \u00fclev\u00f5tt<\/h2>\n\n\n\n<p>\u201eArbitrary File Upload\u201d t\u00e4hendab praktikas, et r\u00fcndaja suudab serverisse kirjutada faili, mille sisu ja asukoha ta ise kontrollib. Kui see fail saab olla n\u00e4iteks PHP skript ning see kirjutatakse veebist ligip\u00e4\u00e4setavasse kataloogi, on j\u00e4rgmine samm trivialne: r\u00fcndaja avab URL-i ja k\u00e4ivitab serveris oma koodi. Reaalses maailmas kasutatakse selleks tihti webshell\u2019e, mis annavad p\u00fcsiva kontrolli saidi ja serveri \u00fcle.<\/p>\n\n\n\n<p>Selle konkreetse juhtumi puhul r\u00f5hutatakse, et r\u00fcndevektor on seotud WPvivid Backupis oleva v\u00f5imalusega <em>vastu v\u00f5tta varukoopia teisest WordPressi saidist<\/em>, mida kaitstakse l\u00fchiajalise genereeritud v\u00f5tmega. Kui seda funktsiooni ei kasutata (v\u00f5tit pole loodud), ei ole r\u00fcnde eeldused t\u00e4idetud.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tehniline taust: mis kooditeel valesti l\u00e4ks?<\/h2>\n\n\n\n<p>Wordfence\u2019i anal\u00fc\u00fcsi j\u00e4rgi on keskne kooditee seotud klassiga <code>WPvivid_Send_to_site<\/code> ja selle meetodiga <code>send_to_site()<\/code>, mis tegeleb teiselt saidilt tuleva varukoopia vastuv\u00f5tmisega. Sisend tuleb <code>$_POST['wpvivid_content']<\/code> v\u00e4ljal, mis base64-dekodeeritakse ning dekr\u00fcpteeritakse.<\/p>\n\n\n\n<p>Probleem oli kahes osas, mis koos tegid r\u00fcnde eriti ebameeldivaks:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Kr\u00fcptograafiline t\u00f5rkehaldus<\/strong>: RSA dekr\u00fcpteerimine v\u00f5ib eba\u00f5nnestuda. Kui sessiooniv\u00f5tme dekr\u00fcpteerimine ei \u00f5nnestu ja tulemuseks on <code>false<\/code>, ei l\u00f5petatud protsessi korrektselt. See <code>false<\/code> v\u00e4\u00e4rtus anti edasi AES\/Rijndael initsialiseerimisele.<\/li>\n\n\n<li><strong>Failitee ja nime ebapiisav valideerimine<\/strong>: \u00fcleslaetava faili nimi v\u00f5eti dekr\u00fcpteeritud payload\u2019ist ning seda ei sanitiseeritud piisavalt. See avas tee directory traversal\u2019ile (kataloogist \u201ev\u00e4lja ronimine\u201d), et kirjutada fail kaitstud backup-kataloogist v\u00e4lja veebist loetavatesse asukohtadesse.<\/li>\n\n<\/ol>\n\n\n\n<p>Kr\u00fcptopoolsest vaatenurgast on t\u00e4helepanuv\u00e4\u00e4rne n\u00fcanss see, et kui <code>openssl_private_decrypt()<\/code>\/RSA dekr\u00fcpteerimine annab <code>false<\/code>, siis phpseclib\u2019i AES\/Rijndael initsialiseerimine k\u00e4sitleb seda sisuliselt kui nullbaitidest koosnevat etteaimatavat v\u00f5tmematerjali. Tulemus: r\u00fcndaja saab koostada kr\u00fcpteeritud payload\u2019i, mis \u201esobib\u201d selle etteaimatava null-bait v\u00f5tmega, ja seel\u00e4bi m\u00f6\u00f6da minna ideest, et ainult \u00f5igesti dekr\u00fcpteeritav sisu j\u00f5uab failikirjutamiseni.<\/p>\n\n\n\n<p>RCE saavutati Wordfence\u2019i kirjelduse j\u00e4rgi suunaga, kus r\u00fcndaja kasutab parameetrit <code>wpvivid_action=send_to_site<\/code>, et j\u00f5uda failide \u00fcleslaadimiseni ning kirjutada n\u00e4iteks pahatahtlik PHP fail avalikku kataloogi.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mida tarnija muutis: parandus 0.9.124-s<\/h2>\n\n\n\n<p>Parandus koosnes kahest t\u00e4iendavast turvakihist, mis on selles kontekstis m\u00f5lemad loogilised ja vajalikud.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Kr\u00fcptov\u00f5tme kontroll: katkesta, kui RSA dekr\u00fcpteerimine eba\u00f5nnestub<\/h3>\n\n\n\n<p><code>decrypt_message()<\/code> funktsioonis lisati kontroll, mis l\u00f5petab dekr\u00fcpteerimisvoo, kui <code>$key<\/code> on <code>false<\/code> v\u00f5i t\u00fchi. Sisuliselt eemaldatakse v\u00f5imalus, et <code>false<\/code> v\u00e4\u00e4rtus j\u00f5uab Rijndael\/AES v\u00f5tmena kasutusse.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>$key = $rsa-&gt;decrypt($key);\n\n\/\/ Patch: \u00e4ra luba false\/t\u00fchja v\u00f5tmega edasi minna\nif ($key === false || empty($key)) {\n    return false;\n}\n\n$rij = new Crypt_Rijndael();\n$rij-&gt;setKey($key);\nreturn $rij-&gt;decrypt($data);\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#E1E4E8\">$key <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> $rsa<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">decrypt<\/span><span style=\"color:#E1E4E8\">($key);<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ Patch: \u00e4ra luba false\/t\u00fchja v\u00f5tmega edasi minna<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">if<\/span><span style=\"color:#E1E4E8\"> ($key <\/span><span style=\"color:#F97583\">===<\/span><span style=\"color:#79B8FF\"> false<\/span><span style=\"color:#F97583\"> ||<\/span><span style=\"color:#79B8FF\"> empty<\/span><span style=\"color:#E1E4E8\">($key)) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    return<\/span><span style=\"color:#79B8FF\"> false<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$rij <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#F97583\"> new<\/span><span style=\"color:#79B8FF\"> Crypt_Rijndael<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$rij<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">setKey<\/span><span style=\"color:#E1E4E8\">($key);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">return<\/span><span style=\"color:#E1E4E8\"> $rij<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">decrypt<\/span><span style=\"color:#E1E4E8\">($data);<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">2) Faililaiendi ja failinime karmim kontroll <code>send_to_site()<\/code>-s<\/h3>\n\n\n\n<p>Lisaks lisati faililaiendi kontroll, et lubada ainult varukoopiaga seotud failit\u00fc\u00fcpe, ning failinime t\u00f6\u00f6tlemine turvalisemaks: kasutatakse <code>basename()<\/code> ning eemaldatakse mitte-lubatud m\u00e4rgid regexiga. Lubatud laiendid: <code>zip<\/code>, <code>gz<\/code>, <code>tar<\/code>, <code>sql<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>$safe_name = basename($params['name']);\n$safe_name = preg_replace('\/[^a-zA-Z0-9._-]\/', '', $safe_name);\n\n$allowed_extensions = array('zip', 'gz', 'tar', 'sql');\n$file_ext = strtolower(pathinfo($safe_name, PATHINFO_EXTENSION));\n\nif (!in_array($file_ext, $allowed_extensions, true)) {\n    $ret['result'] = WPVIVID_FAILED;\n    $ret['error']  = 'Invalid file type - only backup files allowed.';\n    echo wp_json_encode($ret);\n    die();\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#E1E4E8\">$safe_name <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> basename<\/span><span style=\"color:#E1E4E8\">($params[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">]);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$safe_name <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> preg_replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">'\/<\/span><span style=\"color:#DBEDFF\">[^a-zA-Z0-9._-]<\/span><span style=\"color:#9ECBFF\">\/'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">''<\/span><span style=\"color:#E1E4E8\">, $safe_name);<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$allowed_extensions <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> array<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">'zip'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'gz'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'tar'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'sql'<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$file_ext <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> strtolower<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">pathinfo<\/span><span style=\"color:#E1E4E8\">($safe_name, <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\">));<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">if<\/span><span style=\"color:#E1E4E8\"> (<\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\">in_array<\/span><span style=\"color:#E1E4E8\">($file_ext, $allowed_extensions, <\/span><span style=\"color:#79B8FF\">true<\/span><span style=\"color:#E1E4E8\">)) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $ret[<\/span><span style=\"color:#9ECBFF\">'result'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> WPVIVID_FAILED<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $ret[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">]  <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> 'Invalid file type - only backup files allowed.'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">    echo<\/span><span style=\"color:#B392F0\"> wp_json_encode<\/span><span style=\"color:#E1E4E8\">($ret);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    die<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Miks ainult laiendikontroll ei ole kunagi \u201epiisav\u201d<\/h4>\n\n\n<p>Faililaiendi whitelist on vajalik, aga \u00fcksi see ei peaks olema ainus kaitse. Selles konkreetses paranduses on oluline just kombinatsioon: kr\u00fcptovoo korrektne katkestamine + failinime normaliseerimine + laiendite whitelist. (Wordfence\u2019i kirjeldus keskendub nendele muudatustele.)<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Keda see reaalselt m\u00f5jutab?<\/h2>\n\n\n\n<p>Haavatavus puudutab WPvivid Backup &#038; Migrationi versioone <strong>0.9.123 ja varasemaid<\/strong>. Kuid kriitiline r\u00fcndepind tekib siis, kui oled pistikprogrammi seadetes <em>genereerinud v\u00f5tme<\/em>, mis lubab teisel saidil sinu saidile varukoopiat saata. Funktsioon on vaikimisi v\u00e4lja l\u00fclitatud ning v\u00f5tme aegumine on piiratud maksimaalselt 24 tunniga.<\/p>\n\n\n\n<p>Praktiliselt t\u00e4hendab see, et suur osa 800 000 paigaldusest ei pruugi olla otseselt exploitatavad, kui v\u00f5tmega \u201esend to site\u201d pole kunagi sisse l\u00fclitatud. Samas organisatsioonides ja agentuurides, kus tehakse keskkondadevahelist migratsiooni v\u00f5i keskset varundust, on just see funktsionaalsus t\u00f5en\u00e4olisemalt kasutusel.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ajajoon: raporteerimisest patch\u2019ini ja tulem\u00fc\u00fcrireegliteni<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>12.01.2026<\/strong> &#8211; Wordfence sai rapordi (Bug Bounty Program kaudu) suvalise faili \u00fcleslaadimise haavatavuse kohta WPvivid Backupis.<\/li>\n\n\n<li><strong>22.01.2026<\/strong> &#8211; Raport valideeriti ja kinnitati proof-of-concept. Tarnijale saadeti esmane kontakt ning kutse kasutada <a href=\"https:\/\/www.wordfence.com\/threat-intel\/vendor\/vulnerability-management-portal\/\">Wordfence Vulnerability Management Portal<\/a>.<\/li>\n\n\n<li><strong>22.01.2026<\/strong> &#8211; Wordfence Premium, Care ja Response kasutajad said tulem\u00fc\u00fcrireegli, mis aitab blokeerida selle haavatavuse sihtimise katseid.<\/li>\n\n\n<li><strong>23.01.2026<\/strong> &#8211; Tarnija vastas ning eelistas edasist koordineerimist e-posti teel.<\/li>\n\n\n<li><strong>23.01.2026<\/strong> &#8211; Tarnijale edastati t\u00e4ielikud avalikustamise detailid; tarnija kinnitas rapordi ja alustas parandusega.<\/li>\n\n\n<li><strong>28.01.2026<\/strong> &#8211; Avaldati t\u00e4ielikult parandatud pistikprogrammi versioon <strong>0.9.124<\/strong>.<\/li>\n\n\n<li><strong>21.02.2026<\/strong> &#8211; Wordfence Free kasutajad saavad sama tulem\u00fc\u00fcrikaitse.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Mida teha oma WordPressi saitidega (kontrollnimekiri)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Kontrolli WPvivid versiooni<\/strong>: kui see on <code>&lt;= 0.9.123<\/code>, planeeri kohene uuendus.<\/li>\n\n\n<li><strong>Uuenda WPvivid Backup &#038; Migration versioonile 0.9.124<\/strong> (v\u00f5i uuemale).<\/li>\n\n\n<li><strong>Kontrolli, kas \u201esend to site \/ receive backup from another site\u201d funktsioon on kasutusel<\/strong>: kui oled kunagi genereerinud v\u00f5tme, eelda, et risk on oluliselt k\u00f5rgem.<\/li>\n\n\n<li><strong>Kui kasutad Wordfence\u2019i<\/strong>, arvesta ajastusega: Premium\/Care\/Response said kaitse juba 22.01.2026; Free saab kaitse 21.02.2026. (See ei asenda patch\u2019i &#8211; see on lisakiht.)<\/li>\n\n\n<li><strong>Hinda kompromiteerimise m\u00e4rke<\/strong>, kui v\u00f5ti oli aktiivne ja sait oli internetist k\u00e4ttesaadav: suvalised PHP failid avalikes kataloogides, tundmatud admin-kontod, kahtlased cron\u2019id, ootamatud muudetud failid. (Allikas kirjeldab, et sellist t\u00fc\u00fcpi haavatavused viivad tihti webshell\u2019ide kaudu t\u00e4ieliku \u00fclev\u00f5tuni.)<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Kokkuv\u00f5te<\/h2>\n\n\n\n<p>WPvivid Backup &#038; Migrationi (slug <code>wpvivid-backuprestore<\/code>) versioonides kuni 0.9.123 oli kriitiline autentimata suvalise faili \u00fcleslaadimise haavatavus (<strong>CVE-2026-1357<\/strong>, CVSS 9.8), mis teatud seadistuse korral v\u00f5imaldas j\u00f5uda RCE-ni ja sisuliselt t\u00e4ieliku saidi \u00fclev\u00f5tuni. R\u00fcnde eeldus on, et pistikprogrammis on aktiveeritud teiselt saidilt varukoopia vastuv\u00f5tmise v\u00f5imekus ehk seadetes on loodud genereeritud v\u00f5ti; see funktsioon on vaikimisi v\u00e4ljas ja v\u00f5tme eluiga on piiratud (max 24h).<\/p>\n\n\n\n<p>Parandus on v\u00e4ljas versioonis <strong>0.9.124<\/strong>, kus lisati kr\u00fcptovoo korrektne katkestamine eba\u00f5nnestunud RSA dekr\u00fcpteerimisel ning <code>send_to_site()<\/code> teekonnale failinime normaliseerimine ja lubatud varufailide laiendite whitelist. Kui WPvivid on sinu stack\u2019is, on see uuendus sisuliselt kohustuslik.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Viited \/ Allikad<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/02\/800000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-wpvivid-backup-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">800,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in WPvivid Backup WordPress Plugin<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wpvivid-backuprestore\/migration-backup-staging-09123-unauthenticated-arbitrary-file-upload\" target=\"_blank\" rel=\"noopener noreferrer\">Migration, Backup, Staging &lt;= 0.9.123 &#8212; Unauthenticated Arbitrary File Upload<\/a><\/li><li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-1357\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2026-1357<\/a><\/li><li><a href=\"https:\/\/wordpress.org\/plugins\/wpvivid-backuprestore\/\" target=\"_blank\" rel=\"noopener noreferrer\">WPvivid Backup &amp; Migration (WordPress plugin)<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/bug-bounty-program\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Bug Bounty Program<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vendor\/vulnerability-management-portal\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Vulnerability Management Portal<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/products\/wordfence-premium\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Premium<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/products\/wordfence-care\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Care<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/products\/wordfence-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Response<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Kui WPvivid Backup &#038; Migrationi seadetes on aktiveeritud teise saidi poolt varukoopia vastuv\u00f5tmine (genereeritud v\u00f5tmega), v\u00f5ib autentimata r\u00fcndaja laadida serverisse suvalise faili ja j\u00f5uda RCE-ni. Parandus on versioonis 0.9.124.<\/p>\n","protected":false},"author":49,"featured_media":209,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[50],"tags":[56,110,10,13,9],"class_list":["post-210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-turvalisus","tag-haavatavus","tag-plugin","tag-turvalisus","tag-wordfence","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts\/210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/users\/49"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/comments?post=210"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts\/210\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/media\/209"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/media?parent=210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/categories?post=210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/tags?post=210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}