Description

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:17:08.637Z",
  "pubdate": "2026-08-13T14:17:08.637Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the Everest Backup plugin for WordPress, affecting all versions up to and including version 2.3.12. This security flaw allows remote, unauthenticated attackers to manipulate SQL queries by injecting arbitrary SQL commands into vulnerable application parameters. The vulnerability exposes the underlying database to unauthorized access, potentially leading to the extraction of sensitive information such as administrator credentials, user data, and site configurations. Depending on database user privileges and backend configurations, successful exploitation may also facilitate further compromise of the hosting environment. The risk implication is critical, as the vulnerability requires zero authentication or user interaction, lowering the barrier to entry for malicious actors scanning for vulnerable WordPress instances. Mitigation requires updating the Everest Backup plugin beyond version 2.3.12 or applying vendor-supplied patches to remediate the unsafe database query construction.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an SQL command, a classic SQL Injection flaw. Within the affected versions of the Everest Backup plugin, user-supplied input parameters are improperly sanitized, validated, or escaped before being concatenated directly into database queries executed via the underlying WordPress database abstraction layer ($wpdb).\nThe attack flow begins when an unauthenticated remote attacker sends a specially crafted HTTP request containing malicious SQL payloads targeted at the vulnerable endpoint or parameter within the Everest Backup plugin. Because the application lacks adequate input sanitization and fails to utilize prepared statements or parameterized queries, the injected SQL payload is interpreted directly by the database management system as part of the query logic.\nNetwork exposure is fully remote over HTTP/HTTPS, requiring no prior authentication or administrative privileges. The vulnerable component resides within the request handling and data processing routines of Everest Backup version 2.3.12 and earlier. Attackers can leverage techniques such as UNION-based SQL injection, error-based extraction, or blind SQL injection to enumerate database schemas, dump sensitive tables including wp_users, or extract password hashes.\nPost-exploitation impact ranges from severe data confidentiality breaches to potential full site takeover. If the database user configured for the WordPress instance possesses elevated privileges or administrative capabilities, secondary impacts could include arbitrary file reading/writing via database features or remote code execution within the database or application context."
}