CVE-2026-14490

Name of the Vulnerable Software and Affected Versions Demi – One Click Demo Import, WP Backup & Site Migration versions prior to 0.0.8

Description An unauthenticated attacker can recursively delete arbitrary directories on the server. This occurs because the plugin stores its HMAC signing key and per-step restore token as dotfiles in a publicly accessible subdirectory of the WordPress uploads folder without proper protection. The demi restore step AJAX handler allows unauthenticated callers to use the exposed signing key as an alternative to standard capability and nonce checks. By retrieving this key, an attacker can forge a signed state envelope to trigger the CleanDir::execute() function using a caller-supplied absolute path that lacks allow-list or path-canonicalization checks.

Recommendations Update to a version newer than 0.0.7. As a temporary mitigation, restrict public access to the plugin's subdirectory within the WordPress uploads folder to prevent the retrieval of the HMAC signing key.