Junglewise Threat Intelligence

CVE-2026-14490: deveasel Demi WordPress plugin arbitrary directory deletion

CVE-2026-14490 · Severity: high · CVSS 7.5 · Published 2026-07-28

Executive brief

The Demi plugin for WordPress, used for site backups and migrations, contains a security flaw that allows unauthorized individuals to delete folders on the web server. By exploiting improperly secured security keys stored on the site, an attacker can remotely trigger a cleanup function to remove critical system or website directories. This can lead to a total loss of website data or a complete service outage.

Technical details

The Demi plugin for WordPress is vulnerable to arbitrary directory deletion due to improper storage of sensitive HMAC signing keys and a lack of path validation. The plugin stores its signing key as a dotfile in a publicly accessible subdirectory of the WordPress uploads folder without protection. An unauthenticated attacker can retrieve this key and use it to forge a signed state envelope for the 'demi_restore_step' AJAX handler. This handler accepts the signing key as a substitute for standard WordPress capability checks and invokes 'CleanDir::execute()' with a user-supplied absolute path. Because there are no allow-lists or path-canonicalization checks, an attacker can recursively delete any directory the web server has permissions to modify.

Affected products

  • deveasel Demi – One Click Demo Import, WP Backup & Site Migration <= 0.0.7

Timeline

  • 2026-07-28: advisory: Advisory published by Wordfence and NVD.

References

Related threats