Unauthenticated RCE in Everest Backup WordPress Plugin

Unauthenticated RCE in Everest Backup WordPress plugin, versions up to 2.3.13. CVSS 8.1 (high). Update to a version above 2.3.13 immediately.

cat cve-2026-39802.json

Vendor: WPEverest
Product: Everest Backup
CVSS: 8.1
EPSS (exploit probability): 0.5%
Status: patched
Published: October 12, 2026
Source: https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-13-remote-code-execution-rce-vulnerability

An unauthenticated remote code execution vulnerability in the Everest Backup plugin for WordPress. All versions up to and including 2.3.13 are affected. No authentication is required to trigger the flaw.

Patchstack published the disclosure on October 10, 2026. The NVD entry is at https://nvd.nist.gov/vuln/detail/CVE-2026-39802.

Update to a version above 2.3.13. If an immediate patch is not possible, deactivating the plugin removes the attack surface.

Related coverage

~/articles/2026-10-12-everest-backup-wordpress-rce-cve-2026-39802

wordpress

Everest Backup Plugin Has CVSS 8.1 RCE Bug

An unauthenticated RCE flaw in Everest Backup versions up to 2.3.13 lets attackers execute code on WordPress sites without credentials. Patch now.

Oct 12read →