The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress contains an information‑exposure flaw that allows an attacker to read the .restore_key and .restore_step_token files that are written to the wp‑content/uploads/demi‑backup‑state/ directory after a restore operation is started. These files authenticate the AJAX endpoint that processes restore requests. By re‑using the discovered keys, an attacker can forge signed restore requests and instruct the server to copy arbitrary files to arbitrary destinations, effectively gaining write access on the site’s filesystem. The weakness is classified as CWE‑200; its impact is practical data tampering or exfiltration on a server that hosts the affected WordPress installation.

WordPress sites that use any Demi plugin version from 0.0.0 through 0.0.8 inclusive are affected. The vulnerability exists in the handle_restore_step function that runs over an unauthenticated AJAX handler. Sites in which the wp‑content/uploads/demi‑backup‑state/ directory is publicly readable, which is the default configuration for most installations, will expose the restore‑key files once a restore has been initiated.

The CVSS score of 5.3 labels this vulnerability as moderate, and the EPSS score below 1 % indicates a low short‑term exploitation likelihood. It is not listed in the CISA KEV catalog and no public exploits are currently known. The attack requires that an initial restore operation is performed, which is typically carried out by a site administrator; this requirement is inferred from common usage patterns rather than stated outright in the description. Once the keys are publicly retrievable, an attacker can authenticate the otherwise unauthenticated restore endpoint and trigger arbitrary file copy, potentially enabling full site compromise.