WordPress plugin
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High4
- Medium5
- Low0
All Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Remote Code Execution ≤2.3.13Update to 2.3.14 | CVE-2026-39802 | |
| High7.5 | Unauthenticated SQL Injection ≤2.3.12Update to 2.3.13 | CVE-2026-66472 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.3.9No patch available | CVE-2025-62992 | |
| Medium5.3 | Missing Authorization to Unauthenticated Backup Failure ≤2.3.8Update to 2.3.9 | CVE-2025-10304 | |
| Medium5.3 | Missing Authorization ≤2.3.8Update to 2.3.9 | CVE-2025-62946 | |
| Medium5.9 | Missing Authorization to Unauthenticated Information Exposure ≤2.3.5Update to 2.3.6 | CVE-2025-11380 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.3.3Update to 2.3.4 | CVE-2025-49238 | |
| High7.5 | Sensitive Invormation Disclosure via procstat Log ≤2.2.13Update to 2.2.14 | CVE-2024-10028 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload ≤2.2.4Update to 2.2.5 | CVE-2023-7201 | |
| High7.5 | Sensitive Information Exposure via Log File <2.2.0Update to 2.2.0 | CVE-2023-52185 |
- Critical9.8Unauthenticated Remote Code Execution
≤2.3.13Update to 2.3.14
- High7.5Unauthenticated SQL Injection
≤2.3.12Update to 2.3.13
- Medium4.3Cross-Site Request Forgery
≤2.3.9No patch available
- Medium5.3Missing Authorization to Unauthenticated Backup Failure
≤2.3.8Update to 2.3.9
- Medium5.3Missing Authorization
≤2.3.8Update to 2.3.9
- Medium5.9Missing Authorization to Unauthenticated Information Exposure
≤2.3.5Update to 2.3.6
- Medium4.3Cross-Site Request Forgery
≤2.3.3Update to 2.3.4
- High7.5Sensitive Invormation Disclosure via procstat Log
≤2.2.13Update to 2.2.14
- High7.2Authenticated (Admin+) Arbitrary File Upload
≤2.2.4Update to 2.2.5
- High7.5Sensitive Information Exposure via Log File
<2.2.0Update to 2.2.0
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: common questions
Does Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: 1 critical, 4 high, 5 medium. At least one is not fixed in the latest version.
How do I check which version of Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin vulnerability?
CVE-2026-39802, published Oct 6, 2026: Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 - Unauthenticated Remote Code Execution. Severity: Critical (CVSS 9.8).
Is any Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin vulnerability listed in CISA KEV?
No. None of the known Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin vulnerabilities is currently listed in the CISA KEV catalog.