CVE-2025-11380

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11380", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-06T17:13:51.116Z", "datePublished": "2025-10-11T02:24:52.480Z", "dateUpdated": "2026-04-08T17:04:51.324Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:51.324Z"}, "affected": [{"vendor": "everestthemes", "product": "Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location."}], "title": "Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3374193%40everest-backup&new=3374193%40everest-backup&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Carl Pearson"}], "timeline": [{"time": "2025-10-06T17:29:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:42:22.572469Z", "id": "CVE-2025-11380", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T14:14:54.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11380", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:42:22.572469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:42:25.070Z"}}], "cna": {"title": "Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Carl Pearson"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "everestthemes", "product": "Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-06T17:29:02.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3374193%40everest-backup&new=3374193%40everest-backup&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-11T02:24:52.480Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11380", "state": "PUBLISHED", "dateUpdated": "2025-10-14T14:14:54.981Z", "dateReserved": "2025-10-06T17:13:51.116Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T02:24:52.480Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin", "vendor": "everestthemes", "versions": [{"lessThanOrEqual": "2.3.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location."}, {"lang": "es", "value": "El plugin Everest Backup - WordPress Cloud Backup, Migration, Restore & Cloning Plugin para WordPress es vulnerable al acceso no autorizado de datos debido a una verificaci\u00f3n de capacidad faltante en la acci\u00f3n AJAX 'everest_process_status' en todas las versiones hasta la 2.3.5, inclusive. Esto hace posible que atacantes no autenticados recuperen ubicaciones de archivos de copia de seguridad que pueden ser posteriormente accedidos y descargados. Esto s\u00ed requiere que una copia de seguridad est\u00e9 en ejecuci\u00f3n para que un atacante recupere la ubicaci\u00f3n de la copia de seguridad."}], "id": "CVE-2025-11380", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11380", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T13:42:22.572469Z", "version": "2.0.3"}}]}, "published": "2025-10-11T03:15:31.100", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3374193%40everest-backup&new=3374193%40everest-backup&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:45:05.179299+00:00", "value": {"mitigation_remediation": ["Upgrade Everest Backup to the latest version that includes the missing capability check (at least v2.3.6).", "Remove or block the 'everest_process_status' AJAX endpoint via a security plugin or custom code until the issue is fixed. ", "Restrict backup creation to authenticated administrators and store backup files in a non-public directory protected by appropriate permissions."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "All releases of the Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin up to and including version 2.3.5 are affected. The plugin is a WordPress add\u2011on developed by everestthemes that provides cloud backup functionality.", "description_and_impact": "The vulnerability results from a missing capability check on the 'everest_process_status' AJAX action in Everest Backup, allowing any user to query backup file locations. An unauthenticated attacker can obtain the paths of backup files that are then accessible and downloadable from the server. This flaw is a classic missing authorization issue (CWE-862) and lets attackers gain knowledge of sensitive backups, potentially leading to further compromise if the backups contain confidential data or credentials.", "risk_and_exploitability": "The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not currently cataloged in the CISA KEV list. Exploitation requires remote access to the exposed AJAX endpoint and a running backup process, making it a remote information\u2011disclosure risk that could be mitigated by disabling the vulnerable endpoint or updating the plugin. "}}}}, "created": "2025-10-21T13:14:00.480386+00:00", "updated": "2026-04-22T12:45:17.031899+00:00", "vendors": ["everestthemes", "everestthemes$PRODUCT$everest_backup", "wordpress", "wordpress$PRODUCT$wordpress"]}