CVE-2026-14333
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Demi WordPress plugin before version 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection. This allows unauthenticated attackers to download complete backups including the site database and its user password hashes.
Risk Assessment
An attacker can gain access to the entire database and user passwords, leading to full site compromise and data breach.
Recommendation
Update the Demi plugin to version 0.0.7 or later.
Other vulnerabilities in Demi
See all- CVE-2026-15012Medium
The Demi plugin for WordPress up to version 0.0.8 allows unauthenticated attackers to copy arbitrary files on the server via the handle_restore_step function. Lack of access controls on the wp-content/uploads/demi-backup-state/ directory exposes the restore key used to authenticate the unauthenticated AJAX handler. The attack requires a prior restore operation to have been initiated.
- CVE-2026-14490High
The Demi plugin for WordPress up to version 0.0.7 stores the HMAC key and restore token in a publicly accessible subdirectory of uploads. An unauthenticated attacker can retrieve the key and forge a request to the demi_restore_step AJAX handler, allowing recursive deletion of arbitrary directories.
Original NVD description (English source)
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.