CVE-2023-7201

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	Everest Backup	< 2.2.5
everestthemes	everest_backup	< 2.2.5

References

https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/Exploit, Third Party Advisory

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-72026.1The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any CVE-2023-72036.1The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as l CVE-2023-72047.5The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides CVE-2023-72067.8In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CVE-2023-72074.9Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regre CVE-2023-72089.8A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTm CVE-2023-72097.5A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2023-72109.8A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=CVE-2023-72118.1A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component A CVE-2023-72129.8A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php o CVE-2023-72138.8A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function ma CVE-2023-72148.8A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the fu