---
id: "CVE-2026-125853"
page: "https://infrastack.ai/live/CVE-2026-125853"
kind: "vulnerability"
aliases: ["CVE-2026-125853"]
title: "Everest Backup: missing authorization lets attackers reach backup functions"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["everest-backup", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:42+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125853", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# Everest Backup: missing authorization lets attackers reach backup functions

Link for people: https://infrastack.ai/live/CVE-2026-125853 (this .md is for agents)

Everest Backup, a WordPress backup plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control. The affected versions run through 2.3.15, and the source does not say what an attacker can do after bypassing the check.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Everest Backup plugin version in the WordPress admin plugins list or `wp plugin get everest-backup --field=version`
- Confirm whether the installed version is `2.3.15` or earlier

## Fix

- Everest Backup: unknown (the sources do not name a fixed version)

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125853

## From the sources

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_