CVE-2025-10304
📋 TL;DR
The Everest Backup WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to delete backup progress files. This can cause active backups to fail, potentially disrupting backup operations. All WordPress sites using Everest Backup plugin versions up to 2.3.8 are affected.
💻 Affected Systems
- Everest Backup - WordPress Cloud Backup, Migration, Restore & Cloning Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Critical backup operations fail during emergencies, preventing data recovery and causing permanent data loss or extended downtime.
Likely Case
Scheduled or manual backups fail unexpectedly, requiring manual intervention and potentially missing critical backup windows.
If Mitigated
Backup failures are detected quickly, allowing for manual retry with minimal data loss.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.9 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Everest Backup plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 2.3.9+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Everest Backup Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate everest-backup
Restrict Access via Web Application Firewall
allBlock requests to Everest Backup endpoints for unauthenticated users
🧯 If You Can't Patch
- Implement network-level restrictions to block external access to /wp-content/plugins/everest-backup/ endpoints
- Enable WordPress security plugins with vulnerability scanning and firewall capabilities
🔍 How to Verify
Check if Vulnerable:
Check Everest Backup plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin get everest-backup --field=versionVerify Fix Applied:
Verify plugin version is 2.3.9 or higher and test backup functionality📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /wp-admin/admin-ajax.php with action=everest_backup_process_status_unlink from unauthenticated IPs
- Failed backup operations in Everest Backup logs
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=everest_backup_process_status_unlink parameter
SIEM Query:
source="web_server" AND uri="/wp-admin/admin-ajax.php" AND post_data="action=everest_backup_process_status_unlink" AND NOT user_agent="WordPress/*"