A critical missing authorization flaw in the Everest Backup plugin allows unauthenticated attackers to potentially bypass access controls and negatively impact site availability.

This is a CWE-862 missing authorization vulnerability that enables unauthenticated remote attackers to interact with restricted plugin functions due to improper access control enforcement.

The ability for an unauthenticated user to bypass authorization checks poses a significant risk to the integrity and availability of the WordPress environment. Given the high CVSS score of 8.8, this vulnerability could be leveraged to disrupt backup operations or trigger unauthorized administrative actions, potentially leading to total system compromise or data loss.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately deactivate the Everest Backup plugin until the vendor releases a secure version.

Proactive Monitoring: Monitor server access logs for unusual requests directed at the plugin directory or associated AJAX endpoints that deviate from normal administrative traffic.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to the Everest Backup plugin endpoints, effectively providing a virtual patch until the software is updated.

Public Exploit Available: No confirmed public exploit (weaponized or otherwise) is currently available for this vulnerability.

Given the unauthenticated nature of this flaw and the potential for unauthorized access, immediate mitigation is required to protect the WordPress installation. Administrators must prioritize disabling the Everest Backup plugin and monitoring vendor channels for the release of a patched version to restore functionality safely.