{"id":"CVE-2026-125853","kind":"vulnerability","aliases":["CVE-2026-125853"],"related":[],"title":"Everest Backup: missing authorization lets attackers reach backup functions","description":"Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15.","summary":"Everest Backup, a WordPress backup plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control. The affected versions run through 2.3.15, and the source does not say what an attacker can do after bypassing the check.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["everest-backup","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Everest Backup plugin version in the WordPress admin plugins list or `wp plugin get everest-backup --field=version`\n- Confirm whether the installed version is `2.3.15` or earlier","fix":"- Everest Backup: unknown (the sources do not name a fixed version)","status":"open","published_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:44+00:00","updated_at":"2026-11-13T15:48:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:44Z","model":"claude-haiku-5-5","output":{"fix":"- Everest Backup: unknown (the sources do not name a fixed version)","reach":"unknown","title":"Everest Backup: missing authorization lets attackers reach backup functions","impact":"medium","summary":"Everest Backup, a WordPress backup plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control. The affected versions run through 2.3.15, and the source does not say what an attacker can do after bypassing the check.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","everest-backup"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to backup functions, impact not stated by sources","analyst_note":"Check the NVD and Wordfence or vendor advisory for the fixed version, the exact missing check, and the data an attacker can reach.","how_to_check":"- Check the installed Everest Backup plugin version in the WordPress admin plugins list or `wp plugin get everest-backup --field=version`\n- Confirm whether the installed version is `2.3.15` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Everest Backup WordPress plugin at version 2.3.15 or earlier are in the affected range. The sources do not describe which access control settings must be misconfigured for exploitation, so unknown whether a default install is exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4540,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125853':12A,15A '-2026':11A,14A '2.3.15':46B,87C 'access':39B,76C 'affect':42B,81C 'allow':72C 'attack':6A,35B,55B 'author':4A,30B,63C 'backup':2A,8A,18B,22B,25B,68C,71C,83C 'bypass':59B 'check':31B,61B 'configur':38B,75C 'control':40B,77C 'cve':10A,13A 'everest':1A,17B,21B,67C,70C,82C 'everest-backup':16B,69C 'everestthem':66C 'exploit':36B,73C 'function':9A 'incorrect':37B,74C 'issu':80C 'let':5A,33B 'levels.this':79C 'miss':3A,29B,62C 'n/a':85C 'packag':19B 'plugin':26B 'reach':7A 'run':44B 'say':52B 'secur':78C 'sourc':49B 'version':43B 'vulner':64C 'wordpress':20B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Everest Backup WordPress plugin at version 2.3.15 or earlier are in the affected range. The sources do not describe which access control settings must be misconfigured for exploitation, so unknown whether a default install is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["everestbackup","medium","package","wordpress"],"campaign_type":null,"search_a":"'-125853':12A,15A '-2026':11A,14A 'attack':6A 'author':4A 'backup':2A,8A 'cve':10A,13A 'everest':1A 'function':9A 'let':5A 'miss':3A 'reach':7A","search_b":"'2.3.15':46B 'access':39B 'affect':42B 'attack':35B,55B 'author':30B 'backup':18B,22B,25B 'bypass':59B 'check':31B,61B 'configur':38B 'control':40B 'everest':17B,21B 'everest-backup':16B 'exploit':36B 'incorrect':37B 'let':33B 'miss':29B 'packag':19B 'plugin':26B 'run':44B 'say':52B 'sourc':49B 'version':43B 'wordpress':20B,24B","search_c":"'2.3.15':87C 'access':76C 'affect':81C 'allow':72C 'author':63C 'backup':68C,71C,83C 'configur':75C 'control':77C 'everest':67C,70C,82C 'everest-backup':69C 'everestthem':66C 'exploit':73C 'incorrect':74C 'issu':80C 'levels.this':79C 'miss':62C 'n/a':85C 'secur':78C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125853","severity":null,"published_at":"2026-11-13T15:17:42+00:00","modified_at":"2026-11-13T15:17:43+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}