CVE-2025-62946
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
Risk Assessment
Unauthorized users may perform backup or restore operations, potentially leading to data confidentiality breaches or system disruption.
Recommendation
Update the Everest Backup plugin to the latest patched version and review access control configuration.
Other vulnerabilities in Everest Backup
See all- CVE-2026-39802High
The Everest Backup plugin versions up to 2.3.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability.
- CVE-2026-66472Critical
The Everest Backup plugin versions up to 2.3.12 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
Original NVD description (English source)
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS