What is the CVSS score of CVE-2026-66472?

CVE-2026-66472 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Everest Backup are affected by CVE-2026-66472?

The Everest Backup WordPress plugin (versions up to 2.3.12) contains a critical SQL injection flaw that allows unauthenticated attackers to directly access complete database contents, including…

How to fix or mitigate CVE-2026-66472?

Within 24 hours: identify all WordPress sites running Everest Backup plugin version 2.3.12 or earlier via scanning or asset inventory; immediately deactivate the plugin if operationally feasible, or implement Web Application Firewall rules blocking SQL injection patterns if the plugin cannot be disabled immediately. Within 7 days: audit database access logs from the past 30 days for suspicious SQL queries or unauthorized access attempts; engage database administrators to assess whether any unauthorized database reads have occurred. Within 30 days: establish permanent remediation by either upgrading to a patched version once the vendor releases a fix, or migrating to an alternative WordPress backup plugin that has no known critical vulnerabilities.

Everest Backup CVE-2026-66472

EUVD-2026-57890 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-rx3x-8jh6-43rp

WordPress SQLi Everest Backup Wordpress Plugin Everestthemes

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network-reachable SQLi gives PR:N/AC:L and high confidentiality from database reads; scope unchanged within the app, with at most limited integrity impact and no clear availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:30 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

AnalysisAI

SQL injection in the Everest Backup WordPress plugin (versions up to and including 2.3.12) lets remote attackers inject arbitrary SQL through an unauthenticated request, per a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and a base score of 9.3. Reported by Patchstack, the flaw primarily exposes backend database contents (C:H) and can affect availability (A:L); no public exploit or active-exploitation evidence is identified at time of analysis. Because it requires no authentication and low complexity, any exposed site running an affected version is reachable directly over the network.

Technical ContextAI

Everest Backup is a WordPress plugin (vendor CPE cpe:2.3:a:everestthemes:everest_backup) providing site backup, restore, and migration functionality, which typically means it handles archive files, database dumps, and privileged operations. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL query without proper parameterization or sanitization, so crafted input alters query structure. In WordPress plugins this class of bug usually stems from passing request parameters into $wpdb queries without prepare()/placeholders, and here the entry point is reachable without a valid session.

RemediationAI

Upgrade Everest Backup to a release later than 2.3.12; the provided data does not name an exact fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-12-sql-injection-vulnerability) and the plugin's WordPress.org changelog to identify and install the vendor-released patched build. If an update cannot be applied immediately, compensating controls include deploying a WAF or Patchstack's virtual patch to block SQL-injection payloads against the plugin's endpoints, restricting access to the affected plugin routes via web-server rules, or temporarily deactivating and removing the plugin - the trade-off of deactivation is loss of scheduled backup/restore functionality, and WAF rules may require tuning to avoid breaking legitimate backup operations. Do not rely on generic hardening alone, since the vulnerable code path is unauthenticated and directly reachable.