Demi Backup CVE-2026-15012

Exploitation requires that a Demi restore/migration operation be actively in progress at the moment of attack - this is the hard limiter. Only during that window does the plugin write the .restore_key and .restore_step_token files into the world-accessible wp-content/uploads/demi-backup-state/ directory, which lacks HTTP access controls (no index protection, no .htaccess/deny rule). The attacker needs no authentication and no user interaction, but must (a) time the attack to an active restore and (b) harvest the secret then forge a signed restore-state envelope to invoke the unauthenticated handle_restore_step handler. Outside an active restore the secret files are absent and the chain fails. Affected: all versions of the Demi - One Click Demo Import, Backup & Site Migration plugin up to and including 0.0.8.

This is a genuine but conditional, low-to-moderate severity issue - not a drop-everything priority. The signals are internally consistent and point away from mass exploitation: EPSS is 0.32% (24th percentile), there is no CISA KEV listing, no public exploit code was identified, and SSVC scores Exploitation:none. SSVC does flag Automatable:yes with Technical Impact:partial, meaning that IF the narrow precondition is met the attack can be scripted at scale, which is why it is not dismissible. The NVD/Wordfence CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N) is directionally right on severity but two metrics are debatable: (1) AC:L understates the real attack complexity, because exploitation requires an active restore operation to be in progress so that .restore_key and .restore_step_token are transiently present in the public uploads directory - a race/timing window that argues for AC:H; and (2) C:N/I:L understates impact, since an unauthenticated 'arbitrary file copy to attacker-controlled destinations' can be pointed at wp-config.php (DB credentials, auth salts) and copied into a web-readable path, which is a confidentiality breach (C:H is defensible). Net: real risk is bounded primarily by the requirement that an admin be mid-restore, not by attacker skill or authentication.

An unauthenticated attacker polls the target's wp-content/uploads/demi-backup-state/ directory during the window when a site administrator is running a Demi restore/migration; because the directory lacks HTTP access controls, the attacker retrieves the .restore_key and .restore_step_token secrets. With the harvested cryptographic key the attacker forges a signed restore-state envelope and calls the unauthenticated handle_restore_step AJAX handler to copy arbitrary files (e.g. wp-config.php) to an attacker-chosen, web-accessible destination and exfiltrate credentials. No public exploit code was identified at time of analysis, but the flaw is scriptable (SSVC Automatable:yes) once a restore is detected.