Description
WordPress 插件 WPvivid 存在未授权访问漏洞，此漏洞是当用户调用特定函数，例如wp_ajax_nopriv_wpvividstg_start_staging_free时，未充分验证用户的身份而导致的。
WordPress 插件 WPvivid 未授权访问漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.venustech.com.cn/new_type/aqtg/20240301/27094.html
https://avd.aliyun.com/detail?id=AVD-2023-4637
https://nosec.org/m/share/4403.html
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpvivid-backuprestore/wpvivid-backup-plugin-0990-missing-authorization-via-start-staging-and-get-staging-progress
https://nvd.nist.gov/vuln/detail/CVE-2026-1357
https://cyber.gov.rw/updates/article/security-alert-critical-wordpress-plugin-vulnerability-in-wpvivid-backup-cve-2026-1357/
https://cn.wordpress.org/plugins/wpvivid-backuprestore/