WordPress security changelog
HIGH CVE-2026-14490 Deferred

Demi restore state permits unauthenticated arbitrary directory deletion

Demi through 0.0.7 writes the HMAC restore key and per-step token as .restore_key and .restore_step_token beneath the publicly accessible wp-content/uploads/demi-backup-state directory during a restore. The unauthenticated demi_restore_step AJAX action accepts possession of that key instead of the normal manage_options and nonce checks. An attacker who retrieves the files can forge the signed state consumed by handle_restore_step and supply task arguments that reach CleanDir::execute(), which recursively deletes a caller-selected absolute directory without canonicalizing it or restricting it to the uploads tree.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Demi – One Click Demo Import, Backup & Site Migration
Plugin slug
demi-backup-migration
Affected
<= 0.0.7
Safe version
> 0.0.7
Published
Jul 28, 2026
Weakness
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published Jul 28, 2026 and is one of 2 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Demi to a release newer than 0.0.7. The CNA record identifies the affected boundary but does not name a fixed tag. If a restore was run while a vulnerable release was installed, inspect the public demi-backup-state directory and server logs, remove exposed restore secrets, and verify critical site and account files.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources