Executive brief
The Demi plugin for WordPress, which is used for site backups and migrations, contains a security flaw that exposes full website backups to the public internet. Because these backup files are stored in a predictable location without any password protection, anyone can download them. This allows unauthorized individuals to access the entire site database, including sensitive configuration files and user password hashes, potentially leading to a full site takeover.
Technical details
The Demi WordPress plugin (demi-backup-migration) fails to implement proper access controls or filename randomization for its backup archives. Full-site backups are stored in a publicly accessible web directory using a predictable naming convention. An unauthenticated remote attacker can guess the filename and download the archive via a direct HTTP request. These archives typically contain the complete WordPress database, including user credentials (password hashes) and sensitive configuration details. The issue is resolved in version 0.0.7.
Affected products
- Unknown Demi – One Click Demo Import, Backup & Site Migration < 0.0.7
Timeline
- 2026-07-13: disclosed: Initial public disclosure by WPScan
- 2026-07-31: advisory: CVE published to NVD dataset
- 2026-07-13: patched: Fixed in version 0.0.7