CVE-2026-15012

Name of the Vulnerable Software and Affected Versions Demi – One Click Demo Import, WP Backup & Site Migration versions prior to 0.0.9

Description An arbitrary directory copy issue exists via the handle restore step() function. The problem stems from missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key. This key is used to authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. Consequently, unauthenticated attackers can copy arbitrary files to destinations they control on the server. This exploitation requires an active restore operation to have been initiated, as this process writes the .restore key and .restore step token files to the public upload directory, allowing the secrets to be harvested.

Recommendations Update to a version newer than 0.0.8.