EUVD-2026-51409
GHSA-q89r-49r9-5hmx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Demi plugin
-
DeliveryGuess predictable backup archive URL
-
ExploitDownload unprotected backup over HTTP
-
ExecutionExtract database and password hashes
-
PersistCrack hashes offline
-
ImpactLog in and escalate to admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected site must run the Demi WordPress plugin at a version before 0.0.7 AND have generated at least one full-site backup with the plugin, since exploitation requires an existing archive to download. No authentication, user interaction, or special privileges are needed (PR:N/UI:N) and the request is a plain unauthenticated HTTP GET to a predictable path. Limiting factors: exposure is confined to the confidentiality of whatever data is inside the backup (no direct integrity/availability impact), the plugin must be installed and must have run a backup, and sites that placed backups outside the web root or added directory access controls are not exploitable. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated, no-interaction attack, and the impact profile is C:H/I:N/A:N - pure confidentiality loss, which fits a downloadable backup exposing the database rather than direct code execution. Real-world priority is elevated by the confirmed public exploit and the availability of a vendor patch, meaning both attackers and defenders have what they need. Two caveats temper the raw score: the CWE (269, Improper Privilege Management) does not cleanly match an information-exposure bug and is better read as characterizing the secondary privilege-escalation impact once hashes are obtained; and no EPSS or KEV signal was provided, so there is no evidence of widespread automated exploitation yet. Net assessment: genuinely actionable for any site running Demi, but overall fleet risk is bounded by the plugin's apparently small deployment footprint. |
| Exploit ScenarioDerived | An attacker enumerates the target's wp-content backup path and, because the archive filename is predictable and unprotected, directly requests the backup URL over HTTPS with no credentials or user interaction (AV:N/AC:L/PR:N/UI:N). The downloaded archive yields the full site database including WordPress password hashes, which the attacker then cracks offline to obtain administrator credentials. A public exploit for this flaw is available via WPScan, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
RemediationAI
Vendor-released patch: update the Demi plugin to version 0.0.7 or later, which is the primary and authoritative fix per the WPScan advisory (https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/). Because backups already written by vulnerable versions remain exposed, also delete any existing backup archives from the web-accessible directory and rotate all affected secrets - force a password reset for every WordPress account and change database credentials and any API keys stored in the backup, since the hashes may already have been exfiltrated. As interim compensating controls before patching, block web access to the plugin's backup directory with a server rule (e.g. an .htaccess 'Deny from all' or an nginx location deny) or move backups outside the web root; note the trade-off that this can break the plugin's own restore/download functionality. Deactivating the Demi plugin entirely removes the exposure but disables its backup capability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Demi is a backup-oriented plugin for WordPress, the PHP/MySQL content-management platform that powers a large share of public websites. The flaw stems from where and how the plugin persists its output: full-site backup archives are placed inside the web-servable directory tree (typically under wp-content) using a guessable, non-randomized filename and without an .htaccess deny rule, index guard, or authentication check. The assigned CWE-269 (Improper Privilege Management) and the 'Privilege Escalation' tag describe the downstream effect - captured password hashes enable account escalation - but the root cause is really unauthenticated exposure of sensitive files (information disclosure, akin to CWE-200/CWE-538). The CPE is recorded generically as cpe:2.3:a:unknown:demi:*:*:*:*:*:*:*:*, so the vendor is not authoritatively identified in NVD.
Know when Demi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote GET of an unprotected backup (AV:N/AC:L/PR:N/UI:N) fully discloses the database, so C:H with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Articles & Coverage 1
Executive ViewAI
The Demi WordPress plugin before version 0.0.7 allows unauthenticated attackers to access complete site backup archives containing WordPress user password hashes through publicly available exploit code. This enables credential compromise and potential administrative takeover without any authentication requirements. Organizations using this plugin face immediate risk of unauthorized access and complete site compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB