Arbitrary Directory Copy Vulnerability in Demi Plugin for WordPress

CVE-2026-15012

What is CVE-2026-15012?

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress has a vulnerability allowing arbitrary directory copying due to insufficient HTTP access controls. This exposure is found in all versions up to and including 0.0.8, specifically in the handle_restore_step function. The '/wp-content/uploads/demi-backup-state/' directory fails to secure sensitive information, like the cryptographic restore key, which is critical for authenticating the AJAX handler. If an active restore operation has commenced, it creates the .restore_key and .restore_step_token within the public upload directory. This opens the door for unauthenticated attackers to exploit these weaknesses, enabling them to copy arbitrary files to locations controlled by the attacker.

References