CVE-2026-39802
HighCVSS 8.1Summary
The Everest Backup plugin versions up to 2.3.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability.
Risk Assessment
An unauthenticated attacker can execute arbitrary code on the server, potentially leading to full compromise of the site and server.
Recommendation
Immediately update the Everest Backup plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Everest Backup
See all- CVE-2026-66472Critical
The Everest Backup plugin versions up to 2.3.12 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
- CVE-2025-62946Medium
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
Original NVD description (English source)
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS