Everest Backup CVE-2025-11380

Exploitation requires that a backup operation be actively in progress - the 'everest_process_status' AJAX action only discloses a backup file location while a backup is running, which is the primary limiting factor and the reason for the AC:H rating. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N); the attack works against default configurations of the Everest Backup plugin on versions up to and including 2.3.5, because the AJAX action lacks any capability check. The practical limiter is timing: the attacker must poll the endpoint during the narrow window of an administrator-initiated or scheduled backup, so there is no persistent, on-demand exposure.

This is a genuine but moderate-priority issue, not an urgent emergency. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows a network-reachable, unauthenticated flaw (PR:N) but with high attack complexity (AC:H) because exploitation depends on a backup actively running - a condition outside the attacker's control. The impact is confidentiality-only (C:H, I:N, A:N): exposure of backup file locations that can then be downloaded. The EPSS score of 0.40% (32nd percentile) is low, indicating no widespread exploitation activity is expected, and this is consistent with the absence of a CISA KEV listing and no identified public exploit. There is therefore no conflict among the signals: all point to a real-but-opportunistic confidentiality risk whose practical exploitation is gated by timing. The main caveat is that the C:H rating is significant in practice - a WordPress backup archive typically contains the full database (including credentials, user PII, and secrets), so a successful retrieval is highly damaging even though the window of opportunity is narrow.

While a site administrator is running a backup with Everest Backup, an unauthenticated attacker repeatedly calls the unprotected 'everest_process_status' AJAX action to read the in-progress backup's file location, then directly requests and downloads the resulting archive containing the full site and database. No public exploit code has been identified, and the attack only succeeds during the limited window in which a backup is actually running.