CVE-2026-15012
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Demi plugin for WordPress up to version 0.0.8 allows unauthenticated attackers to copy arbitrary files on the server via the handle_restore_step function. Lack of access controls on the wp-content/uploads/demi-backup-state/ directory exposes the restore key used to authenticate the unauthenticated AJAX handler. The attack requires a prior restore operation to have been initiated.
Risk Assessment
Attackers can copy sensitive files such as configurations or databases to attacker-controlled locations, potentially leading to full site compromise.
Recommendation
Immediately update the Demi plugin to the latest version that fixes this vulnerability and restrict access to the demi-backup-state directory.
Other vulnerabilities in Demi
See all- CVE-2026-14333High
The Demi WordPress plugin before version 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection. This allows unauthenticated attackers to download complete backups including the site database and its user password hashes.
- CVE-2026-14490High
The Demi plugin for WordPress up to version 0.0.7 stores the HMAC key and restore token in a publicly accessible subdirectory of uploads. An unauthenticated attacker can retrieve the key and forge a request to the demi_restore_step AJAX handler, allowing recursive deletion of arbitrary directories.
Original NVD description (English source)
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.