Demi – One Click Demo Import, Backup & Site Migration

Demi through 0.0.8 writes .restore_key and .restore_step_token beneath the publicly accessible wp-content/uploads/demi-backup-state directory while a restore is active. An unauthenticated attacker who retrieves those secrets can call the demi_restore_step AJAX action, forge the signed restore-state envelope processed by handle_restore_step, and make the RestoreFiles task copy caller-selected filesystem content to a caller-selected destination. The primitive depends on an active restore having created the exposed secret files.

Demi through 0.0.7 writes the HMAC restore key and per-step token as .restore_key and .restore_step_token beneath the publicly accessible wp-content/uploads/demi-backup-state directory during a restore. The unauthenticated demi_restore_step AJAX action accepts possession of that key instead of the normal manage_options and nonce checks. An attacker who retrieves the files can forge the signed state consumed by handle_restore_step and supply task arguments that reach CleanDir::execute(), which recursively deletes a caller-selected absolute directory without canonicalizing it or restricting it to the uploads tree.