CVE-2025-10304 is a vulnerability identified in the Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin, affecting all versions up to and including 2.3.8. The root cause is a missing authorization check in the process_status_unlink() function, which is responsible for managing backup progress files. Because the function does not verify user capabilities, unauthenticated attackers can invoke it to delete these progress files. This unauthorized deletion disrupts ongoing backup operations, causing them to fail. The vulnerability is classified under CWE-862 (Missing Authorization), indicating a failure to enforce proper access controls. The CVSS v3.1 base score is 5.3, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning the attack can be performed remotely without privileges or user interaction, impacts integrity but not confidentiality or availability, and has an unchanged scope. Although no exploits have been observed in the wild, the ease of exploitation and potential to disrupt backup reliability make it a concern for organizations using this plugin. The lack of patch links suggests that a fix may not yet be publicly available, emphasizing the need for interim mitigations.

The primary impact of this vulnerability is on the integrity of backup operations. By allowing unauthenticated attackers to delete backup progress files, the vulnerability can cause backup processes to fail, potentially leading to incomplete or missing backups. This disruption can hinder an organization's ability to recover data after incidents such as ransomware attacks, data corruption, or accidental deletion. While it does not directly expose sensitive data or cause denial of service, the inability to reliably create backups increases operational risk and may extend recovery times. Organizations that depend heavily on automated WordPress backups for business continuity and disaster recovery are particularly vulnerable. The attack requires no authentication and no user interaction, increasing the risk of automated exploitation attempts. However, since the vulnerability does not affect confidentiality or availability directly, the overall impact is moderate but significant in environments where backup integrity is critical.

1. Apply patches or updates from the vendor as soon as they become available to address the missing authorization check. 2. In the absence of an official patch, restrict access to the WordPress plugin files and functions by implementing web application firewall (WAF) rules that block unauthorized requests targeting the process_status_unlink() function or related endpoints. 3. Limit exposure by ensuring that the WordPress admin interface and plugin endpoints are accessible only to trusted IP addresses or via VPN. 4. Monitor web server and application logs for unusual requests or repeated attempts to access backup-related functions without authentication. 5. Regularly verify the integrity and completeness of backups to detect any failures or tampering early. 6. Consider disabling or replacing the Everest Backup plugin with alternative backup solutions that enforce proper authorization controls until a fix is available. 7. Educate administrators about the risk and encourage prompt response to any backup failures.