What is the CVSS score of CVE-2026-13158?

CVE-2026-13158 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Everest Toolkit are affected by CVE-2026-13158?

Everest Toolkit WordPress plugin versions 1.2.3 and earlier contain a critical remote code execution vulnerability allowing authenticated administrators to upload and execute malicious PHP code…

Is there a public PoC exploit available for CVE-2026-13158?

Yes, a public proof-of-concept exploit is available for CVE-2026-13158. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-13158?

Within 24 hours: Disable and deactivate the Everest Toolkit plugin on all WordPress installations. Within 7 days: Audit administrator account activity, scan wp-content/uploads for unauthorized .php files, and inventory all affected installations. Within 30 days: Completely remove the plugin from production; restrict administrator role assignments to vetted personnel; and configure your web server to deny PHP execution in the uploads directory using .htaccess or web server rules.

Everest Toolkit CVE-2026-13158

EUVD-2026-51714 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-01 WPScan

GHSA-gv5c-hx24-mwv4

PHP WordPress File Upload Everest Toolkit Unknown

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

PR:H confirmed by mandatory Administrator authentication; AV:N because the import endpoint is web-accessible; full C/I/A reflects arbitrary PHP execution yielding complete server compromise.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 22:31 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

7.2 (HIGH)

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

AnalysisAI

Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.

Technical ContextAI

The affected component is the demo-content import functionality of the Everest Toolkit WordPress plugin (CPE: cpe:2.3:a:unknown:everest_toolkit:*:*:*:*:*:*:*:*, versions ≤1.2.3). WordPress provides a native file-type validation mechanism - wp_check_filetype_and_ext combined with MIME sniffing - specifically designed to block dangerous executable uploads from reaching the web-accessible uploads directory. The root cause (CWE-434: Unrestricted Upload of File with Dangerous Type) is the plugin's deliberate disabling of this WordPress security gate during demo import processing. Because wp-content/uploads is served directly by the web server and PHP files within it are typically executable, any uploaded PHP script becomes a live, reachable web shell. The vendor CPE string lists the vendor as 'unknown,' indicating incomplete NVD attribution; WPScan serves as the authoritative disclosure source for this vulnerability.

RemediationAI

No vendor-released patched version is confirmed in the available data - the referenced WPScan advisory (https://wpscan.com/vulnerability/f101071f-402a-40a2-bbdb-666512cd4049/) should be monitored for patch release. In the interim, immediately deactivate and remove the Everest Toolkit plugin from all affected WordPress installations; this eliminates the vulnerable code path entirely with no functional trade-off. If plugin removal is not feasible, implement PHP execution blocking within wp-content/uploads at the web-server layer: for Apache, add an .htaccess file to the uploads directory containing 'php_flag engine off' and a FilesMatch rule denying .php requests; for nginx, add a location block matching ~* \.php$ within the uploads path returning 403. This compensating control prevents uploaded PHP files from executing even if the upload succeeds, though it does not block the upload itself. Additionally, audit the uploads directory for existing unexpected .php files that may predate remediation, and on multisite networks review all site administrator accounts for legitimacy.