A Cross‑Site Request Forgery flaw in the Everest Backup plugin, affecting versions 2.3.11 and earlier, allows an attacker to submit forged requests that the plugin accepts as legitimate. The flaw enables path traversal, which can lead to arbitrary modification or deletion of files on the WordPress installation, potentially allowing the attacker to overwrite configuration files, inject malicious code, or otherwise tamper with site content. The primary weakness is the lack of proper request validation, as identified by CWE-352.

WordPress sites installing the Everest Backup plugin from Everest Themes, specifically any deployment using version 2.3.11 or older. All WordPress installations that include this plugin and fall within the stated version range are affected.

Based on the description, the likely attack vector is a CSRF exploit that leverages the lack of nonce verification to trigger path traversal operations. The vulnerability carries a CVSS score of 6.5, indicating medium severity. The EPSS score is below 1 %, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. Attackers would need to trick an authenticated user or a logged‑in session into sending a malicious request; the absence of nonce or proper integrity checks enables the exploit. Given the moderate score and low EPSS, the risk is limited but still warrants remediation.