First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-66472

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
everestthemes	Everest Backup	<= 2.3.12

References

https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-12-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-664737.5Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.CVE-2026-664744.3Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.CVE-2026-664755.9Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.CVE-2026-664764.9Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.CVE-2026-664775.3Unauthenticated Broken Access Control in Gillion <= 4.13 versions.CVE-2026-664789.3Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.CVE-2026-664797.1Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPCompl CVE-2026-66483.5A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Modu CVE-2026-664805.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Ret CVE-2026-664816.8Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.CVE-2026-664829.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.CVE-2026-664839.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

CVE-2026-66472: Critical severity, CVSS 9.3 | Vulnix