Sahraoui Aymen

**Name of the Vulnerable Software and Affected Versions** Demi – One Click Demo Import, WP Backup & Site Migration versions prior to 0.0.9 **Description** An arbitrary directory copy issue exists via the `handle restore step()` function. The problem stems from missing HTTP access controls on the `wp-content/uploads/demi-backup-state/` directory, which exposes the cryptographic restore key. This key is used to authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. Consequently, unauthenticated attackers can copy arbitrary files to destinations they control on the server. This exploitation requires an active restore operation to have been initiated, as this process writes the `.restore key` and `.restore step token` files to the public upload directory, allowing the secrets to be harvested. **Recommendations** Update to a version newer than 0.0.8.