Description
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Published: 2026-07-31
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Demi WordPress plugin version prior to 0.0.7 stores full‑site backup archives in a publicly accessible location with predictable filenames and no access control, allowing anyone on the internet to download complete backups that contain the site database and user password hashes. This exposes the site's sensitive data, including potentially login credentials and confidential content, to unauthenticated attackers.

Affected Systems

All installations of the Demi plugin v0.0.6 and earlier are affected. The vulnerability is present in any WordPress site that has installed the plugin before the 0.0.7 release.

Risk and Exploitability

The vulnerability can be exploited simply by accessing the predictable URL of the backup file, as no authentication is required. Because the backups contain the full database, compromised password hashes could enable credential stuffing or brute‑force attacks against other services. The CVSS score is not provided, EPSS is unavailable, and the vulnerability is not listed in CISA's KEV catalog, yet the exposure of critical data makes the risk high.

Generated by OpenCVE AI on July 31, 2026 at 18:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Demi plugin to v0.0.7 or later, which removes the public backup storage.
  • Configure the backup directory to be non‑public or protected by authentication and proper access controls.
  • Review, delete, or sanitize any backups that may have been publicly exposed, revoke compromised password hashes, and reset site administrator passwords.

Generated by OpenCVE AI on July 31, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 31 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 31 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Title Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-31T13:34:20.830Z

Reserved: 2026-07-01T12:45:23.891Z

Link: CVE-2026-14333

cve-icon Vulnrichment

Updated: 2026-07-31T13:34:17.581Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T19:00:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control