Junglewise Threat Intelligence

CVE-2026-15012: deveasel Demi WordPress plugin arbitrary directory copy

CVE-2026-15012 · Severity: medium · CVSS 5.3 · Published 2026-07-28

Executive brief

The Demi plugin for WordPress, which is used for website backups and migrations, contains a security flaw that could allow unauthorized users to copy files on the server. This occurs because the plugin fails to protect sensitive temporary keys during a site restoration process. If an attacker accesses these keys while a restoration is active, they could potentially move files to locations they control, compromising the integrity of the website's data.

Technical details

The vulnerability exists in the handle_restore_step function of the Demi WordPress plugin. It stems from missing HTTP access controls on the 'wp-content/uploads/demi-backup-state/' directory. During an active restore operation, the plugin writes sensitive files (.restore_key and .restore_step_token) to this publicly accessible directory. An unauthenticated attacker can harvest these cryptographic keys to authenticate against the AJAX handler and forge signed restore-state envelopes, enabling the copying of arbitrary directories to attacker-controlled destinations on the server. This exploit requires a legitimate restore operation to be in progress to generate the necessary secrets.

Affected products

  • deveasel Demi – One Click Demo Import, WP Backup & Site Migration up to, and including, 0.0.8

Timeline

  • 2026-07-28: disclosed: CVE published by Wordfence/NVD

References

Related threats