CVE-2025-11380

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3374193%40everest-backup&new=3374193%40everest-backup&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=cve

Published

Oct 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11375Consul and Consul Enterprise’s (“Consul”) event endpoint is …6.5
• CVE-2025-11376The Colibri Page Builder plugin for WordPress is vulnerable …6.4
• CVE-2025-11377The List category posts plugin for WordPress is vulnerable t…4.3
• CVE-2025-11378The ShortPixel Image Optimizer – Optimize Images, Convert We…5.4
• CVE-2025-11379The WebP Express plugin for WordPress is vulnerable to infor…5.3
• CVE-2025-1138IBM InfoSphere Information Server 11.7 could disclose sensit…4.3
• CVE-2025-11381Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-11382Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-11383Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-11384Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-11385A vulnerability has been found in Tenda AC20 up to 16.03.08.…8.8
• CVE-2025-11386A vulnerability was found in Tenda AC15 15.03.05.18. The imp…8.8