Executive brief
The Demi plugin for WordPress, used for site backups and migrations, contains a security flaw that allows unauthorized individuals to delete folders on the web server. By exploiting improperly secured security keys stored on the site, an attacker can remotely trigger a cleanup function to remove critical system or website directories. This can lead to a total loss of website data or a complete service outage.
Technical details
The Demi plugin for WordPress is vulnerable to arbitrary directory deletion due to improper storage of sensitive HMAC signing keys and a lack of path validation. The plugin stores its signing key as a dotfile in a publicly accessible subdirectory of the WordPress uploads folder without protection. An unauthenticated attacker can retrieve this key and use it to forge a signed state envelope for the 'demi_restore_step' AJAX handler. This handler accepts the signing key as a substitute for standard WordPress capability checks and invokes 'CleanDir::execute()' with a user-supplied absolute path. Because there are no allow-lists or path-canonicalization checks, an attacker can recursively delete any directory the web server has permissions to modify.
Affected products
- deveasel Demi – One Click Demo Import, WP Backup & Site Migration <= 0.0.7
Timeline
- 2026-07-28: advisory: Advisory published by Wordfence and NVD.
References
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Backup/Tasks/CleanDir.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Backup/Tasks/CleanDir.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Import/Manager.php
- https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Import/Manager.php