Everest Backup Plugin Has CVSS 8.1 RCE Bug
An unauthenticated RCE flaw in Everest Backup versions up to 2.3.13 lets attackers execute code on WordPress sites without credentials. Patch now.
Marisol "Fuse" DelgadoEverest Backup for WordPress has an unauthenticated remote code execution vulnerability tracked as CVE-2026-39802. The flaw covers all versions up to and including 2.3.13 and carries a CVSS score of 8.1 (high), per a Patchstack disclosure published October 10, 2026.
No authentication is required to trigger the flaw. Any internet-accessible WordPress site running a vulnerable version of the plugin is exposed.
Backup plugins are worthwhile targets. They routinely contain database exports, file archives, and configuration data, so code execution in that context gives an attacker considerably more to work with than a typical plugin compromise.
Update Everest Backup to a version above 2.3.13 through Plugins > Updates in your WordPress admin. If you can’t patch right now, deactivating the plugin closes the exposure until you can.
For the full technical advisory, see the Patchstack writeup.
Related coverage: SiteVault WordPress Plugin Has CVSS 10 RCE Bug | Booster for WooCommerce Has CVSS 9.8 Object Injection | Three Critical WooCommerce Plugins Need Patching
- [ HIGH ]CVE-2026-39802Unauthenticated RCE in Everest Backup WordPress Plugin
Found this useful? Share it.
