Everest Backup CVE-2026-39802

Target must run the Everest Backup WordPress plugin at version 2.3.13 or earlier and expose the vulnerable endpoint to the attacker over the network. The CVSS vector is unauthenticated (PR:N) with no user interaction (UI:N), so no login or admin action is required; however, AC:H indicates a meaningful limiting factor - exploitation depends on a condition the attacker does not fully control (e.g., a specific plugin state, a timing/race window, or a particular configuration/data value reaching the injection sink). The provided description does not name the exact feature, parameter, or configuration that triggers the flaw, so the precise precondition behind AC:H should be verified against the Patchstack advisory before assessing per-site reachability. Primary limiting factors: the AC:H condition and the requirement that the vulnerable Everest Backup version be installed and network-reachable.

This is a genuinely serious vulnerability but not an automatic drop-everything emergency, and the signals are partly in tension. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes network-reachable, unauthenticated exploitation with no user interaction, and the triple-high impact (C:H/I:H/A:H) is consistent with CWE-94 code injection yielding full remote code execution - hence the 8.1 (High) base score. The key mitigating signal is AC:H: the attacker must win some race, meet a specific precondition, or control data that is not always attacker-controlled, so reliable mass exploitation is not guaranteed. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation - this is a pre-exploitation, patch-ahead-of-weaponization situation rather than a confirmed in-the-wild threat. The main driver of real-world risk is therefore the combination of unauthenticated network access plus RCE on a WordPress plugin, tempered by AC:H and the absence of any exploitation telemetry. Treat as a high-priority patch for affected sites, but the lack of KEV/EPSS/POC means this is likely opportunistic/future risk, not confirmed widespread exploitation.

A remote, unauthenticated attacker reaches an internet-facing WordPress site running Everest Backup 2.3.13 or earlier and sends a crafted request that reaches the vulnerable code path, injecting attacker-controlled code (CWE-94) that the plugin executes on the server. Because the CVSS vector marks AC:H, the attacker must satisfy a non-trivial condition or win a timing/state dependency for the request to succeed, so exploitation is realistic but not fully trivial. No public exploit code was identified in the provided data at the time of analysis.