The vulnerability results from a missing capability check on the 'everest_process_status' AJAX action in Everest Backup, allowing any user to query backup file locations. An unauthenticated attacker can obtain the paths of backup files that are then accessible and downloadable from the server. This flaw is a classic missing authorization issue (CWE-862) and lets attackers gain knowledge of sensitive backups, potentially leading to further compromise if the backups contain confidential data or credentials.

All releases of the Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin up to and including version 2.3.5 are affected. The plugin is a WordPress add‑on developed by everestthemes that provides cloud backup functionality.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not currently cataloged in the CISA KEV list. Exploitation requires remote access to the exposed AJAX endpoint and a running backup process, making it a remote information‑disclosure risk that could be mitigated by disabling the vulnerable endpoint or updating the plugin.