Everest Backup WordPress plugin: Unauthenticated remote code execution
Summary
The Everest Backup WordPress plugin up to and including version 2.3.13 contains an unauthenticated remote code execution vulnerability (CWE-94, code injection). An attacker on the internet can send crafted requests to a vulnerable website and run commands on the web server without logging in. Practical exploitation is considered complex, no public exploit is confirmed, and no fixed version is available yet.
Affected
- Everest Backup WordPress plugin (everestthemes), version 2.3.13 and earlier
- Versions before 2.3.13 are covered by the same range
Fixed in
Unknown. No fixed version has been published. Version 2.3.13 is within the affected range and must not be considered safe.
Workaround
- Deactivate and remove the plugin if it is not essential
- If the plugin is required, restrict access to the site with a WAF or network controls
- Use a Web Application Firewall rule for this vulnerability if available from your provider; no vendor-provided rule is known
- Keep verified offline backups
Exploitation
- Known exploited (KEV): not listed
- Public proof of concept: none confirmed; status unknown
- EPSS score: 0.00448 (low)
- Detection content has been published by Qualys (October 2026)
- CISA SSVC: exploitation none, not automatable, total technical impact
Our recommendation
- Inventory all WordPress sites and check whether Everest Backup is installed and which version is active
- Remove the plugin where it is not essential
- Where it is needed, restrict access, apply WAF protection and create fresh offline backups
- Review web server logs for unusual requests to the plugin, and check for new admin users or unknown files
- Monitor the WordPress.org changelog and the Patchstack/NVD entries for a fix, then re-check the affected range
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39802 patchstack.com
- Ionix threat center CVE-2026-39802 www.ionix.io
- WordPress.org plugin Everest Backup wordpress.org
- Qualys application-security detections October 2026 notifications.qualys.com
- Rapid7 via Vulners (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:14.
Original description (NVD)
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.