CVE-2025-10304: Everest Backup Plugin Auth Bypass Flaw

CVE-2025-10304 Overview

CVE-2025-10304 is a missing authorization vulnerability in the Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin. The flaw affects all plugin versions up to and including 2.3.8. The plugin fails to enforce a capability check on the process_status_unlink() function. Unauthenticated attackers can invoke this function over the network to delete backup progress files. Deletion of these files causes any in-progress backup operation to fail. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can interrupt WordPress backup operations by deleting progress files, undermining backup integrity and availability.

Affected Products

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin (versions ≤ 2.3.8)
WordPress sites with the vulnerable plugin installed and active
Environments relying on Everest Backup for scheduled or on-demand backups

Discovery Timeline

2025-12-03 - CVE-2025-10304 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10304

Vulnerability Analysis

The vulnerability resides in the process_status_unlink() function inside the Everest Backup plugin. This function is responsible for removing status or progress tracking files created during backup operations. The plugin exposes the function through a WordPress AJAX or handler endpoint without validating the requester's capabilities or nonce. Any anonymous HTTP request reaching the endpoint can trigger file deletion of backup progress artifacts. Because backup routines depend on these tracking files to persist state, their removal terminates the ongoing backup workflow. The result is a targeted integrity and availability impact on the site's backup subsystem.

Root Cause

The root cause is a missing capability check [CWE-862]. The process_status_unlink() handler does not call current_user_can() or verify a WordPress nonce before performing destructive file operations. Access control was assumed but never enforced at the handler level.

Attack Vector

Exploitation requires only network access to the target WordPress site. No authentication, user interaction, or elevated privileges are needed. An attacker sends a crafted HTTP request to the plugin's status handler while a backup is running. The plugin removes the referenced progress file and the backup operation fails. Consult the Wordfence Vulnerability Report and the WordPress Changeset Update for the corrective code diff.

Detection Methods for CVE-2025-10304

Indicators of Compromise

Unexpected failures or aborted runs of Everest Backup jobs without administrator intervention.
Missing or truncated backup progress files inside the plugin's working directory under wp-content.
Anonymous HTTP POST requests to Everest Backup AJAX endpoints referencing process_status_unlink or status handlers.
Repeated backup restart events in WordPress logs correlated with external IP requests.

Detection Strategies

Review WordPress and web server access logs for unauthenticated requests hitting admin-ajax.php with action parameters tied to Everest Backup.
Alert on backup job failure events emitted by the plugin, especially those clustered in time.
Compare installed plugin versions against 2.3.8 and flag any host running an unpatched build.

Monitoring Recommendations

Enable file integrity monitoring on the Everest Backup working directory to detect unexpected file deletions.
Forward WordPress application logs and web server logs to a centralized SIEM for correlation.
Track backup completion success rates as a key operational metric and investigate deviations.

How to Mitigate CVE-2025-10304

Immediate Actions Required

Update the Everest Backup plugin to a version later than 2.3.8 that contains the fix referenced in the WordPress plugin changeset.
Audit WordPress sites across the estate to identify vulnerable installations of the plugin.
Restrict access to admin-ajax.php from untrusted networks where feasible using a web application firewall.

Patch Information

The vendor addressed the flaw in the plugin update tracked by the WordPress Changeset Update. The fix adds capability and nonce verification to the process_status_unlink() handler so only authorized administrators can trigger file removal. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate the Everest Backup plugin until the patched release can be installed.
Deploy WAF rules that block unauthenticated requests to the plugin's status endpoints.
Limit administrative and AJAX endpoints to trusted source IP ranges through server or reverse proxy configuration.

bash

# Configuration example: block unauthenticated access to the vulnerable action via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "everest_backup.*process_status_unlink") {
        return 403;
    }
}