{"id":"CVE-2026-39802","published":"2026-10-10T20:16:33.613","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-13-remote-code-execution-rce-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote code execution vulnerability in Everest Backup allows attackers to execute arbitrary code on the target system without authentication. This is particularly dangerous because it affects versions up to 2.3.13 and can lead to full system compromise.","exploitability":"Exploitation requires no authentication and is relatively straightforward, though may need a specific payload format or input handling that could introduce complexity.","blast_radius":"The vulnerability could affect any system running Everest Backup 2.3.13 or earlier, potentially allowing attackers to gain complete control over the backup server and access to all backed-up data.","remediation":"Upgrade to version 2.3.14 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","unauthenticated","backup"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:47.157Z"}}