What is the CVSS score of CVE-2026-15012?

CVE-2026-15012 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Demi Backup CVE-2026-15012

EUVD-2026-49691 MEDIUM

Information Exposure (CWE-200)

2026-07-28 Wordfence

GHSA-4p37-mx5p-f6gr

WordPress Information Disclosure Wordpress Plugin Demi One Click Demo Import Backup Site Migration

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated network attack (PR:N/AV:N) but gated on an in-progress restore race window (AC:H); arbitrary file copy can exfiltrate wp-config.php credentials (C:H) and place attacker files (I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 06:52 vuln.today

CVE Published

Jul 28, 2026 - 05:39 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.

AnalysisAI

Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.

Technical ContextAI

The affected component is the Demi WordPress backup/migration plugin (CPE vendor deveasel), whose restore pipeline is implemented in classes/Import/Manager.php (notably the handle_restore_step routine around lines 50/287/460) with file operations in classes/Import/Tasks/RestoreFiles.php (line 168) and helpers in includes/helper-functions.php (line 55). The root cause class is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor: instead of relying solely on WordPress nonces or capability checks, the plugin authenticates its restore-state envelopes with a cryptographic key materialized on disk as .restore_key and .restore_step_token inside wp-content/uploads/demi-backup-state/. Because that directory has no HTTP access controls (no deny rule, no index protection, no non-guessable naming), the same secret that validates the signed envelope is retrievable over plain HTTP, collapsing authentication into a secret-disclosure problem - once the key is read, an attacker can mint a valid signature and drive the restore steps themselves. The write is transient, occurring only while a restore is in progress, which is why the assessed vector raises attack complexity (AC:H) relative to the vendor score while keeping PR:N/UI:N.

RemediationAI

Upgrade the Demi - One Click Demo Import, Backup & Site Migration plugin to a release later than 0.0.8 as soon as one is published; an upstream code fix is visible in the plugin Trac changeset 3616690 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3616690%40demi-backup-migration&new=3616690%40demi-backup-migration), so upstream fix available (PR/commit); released patched version not independently confirmed - verify the plugin version after updating against the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/61ee1857-aa85-4d37-a347-a1f59c95cbff?source=cve. If immediate upgrade is not possible, the most targeted compensating control is to deny HTTP access to the wp-content/uploads/demi-backup-state/ directory at the web-server layer (Apache: a deny-from-all .htaccess/Location block for that path; nginx: a location ~ ^/wp-content/uploads/demi-backup-state/ { deny all; } rule) and additionally block requests for dotfiles and .restore_* names; the trade-off is that this changes nothing for the plugin's server-side file reads, so restore operations still function, but any third-party integration that fetches those files over HTTP would break, and the rule must not be lost on uploads-directory resets. Deleting stale .restore_key and .restore_step_token files and ensuring no restore/migration job is left running removes the secret exposure window entirely, at the cost of needing to restart any interrupted restore. If backups are handled by another mechanism, deactivating and removing the plugin eliminates the attack surface; otherwise restrict admin-side restore initiation to trusted operators (since the chain requires someone to start a restore) and monitor wp-content/uploads/demi-backup-state/ for unexpected file writes or outbound copies. Note that no vendor-released patch version was independently confirmed at time of analysis.