The Demi – One Click Demo Import, WP Backup & Site Migration plugin contains a flaw that allows an unauthenticated attacker to delete arbitrary directories on the server. The issue arises because the plugin stores signing keys and restore tokens as dotfiles in a publicly accessible subdirectory of WordPress’s uploads folder and exposes a demi_restore_step AJAX handler that accepts a forged signed request without checking WordPress capabilities or nonces. By reading the exposed dotfiles, an attacker can craft a request that invokes CleanDir::execute() with any absolute path, and because the path is not validated against an allow‑list or canonicalized, the plugin will recursively delete that directory. The vulnerability affects all Demi plugin releases up to and including version 0.0.7. Any WordPress installation that hosts the plugin and leaves the uploads subdirectory exposed to the web is vulnerable. The CVSS score of 7.5 indicates high impact with potential data loss and site downtime. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Exploitation requires only unauthenticated web access to read the vulnerable dotfiles, after which an attacker can trigger directory deletion with the AJAX endpoint, causing irreversible damage to site content and configuration files.

The Demi plugin – One Click Demo Import, WP Backup & Site Migration – is impacted. All versions up to and including 0.0.7 are vulnerable. The flaw resides within the plugin’s storage of HMAC signing keys and per‑step restore tokens as dotfiles in a publicly accessible subdirectory of the WordPress uploads folder, and the unprotected demi_restore_step AJAX handler. WordPress sites that have this plugin installed and expose the uploads subdirectory to the internet are at risk. The latest patch is available in version 0.0.8 and newer releases of the plugin.

The vulnerability is rated CVSS 7.5, indicating a high severity. The EPSS score is below 1%, indicating that, at present, the likelihood of exploitation is low. It is not listed in CISA KEV. The attack vector requires only unauthenticated web access: an attacker first retrieves the exposed dotfiles, then submits a forged signed request to the demi_restore_step AJAX endpoint with a crafted absolute path. Because the path is not validated or canonicalized, the CleanDir::execute() method will recursively delete the specified directory, resulting in data loss or site compromise. The vulnerability grants complete directory deletion authority, effectively giving the attacker control over the file system within the scope of the web server’s document root.