EUVD-2026-51409
GHSA-q89r-49r9-5hmx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote GET of an unprotected backup (AV:N/AC:L/PR:N/UI:N) fully discloses the database, so C:H with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Articles & Coverage 1
AnalysisAI
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected site must run the Demi WordPress plugin at a version before 0.0.7 AND have generated at least one full-site backup with the plugin, since exploitation requires an existing archive to download. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated, no-interaction attack, and the impact profile is C:H/I:N/A:N - pure confidentiality loss, which fits a downloadable backup exposing the database rather than direct code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates the target's wp-content backup path and, because the archive filename is predictable and unprotected, directly requests the backup URL over HTTPS with no credentials or user interaction (AV:N/AC:L/PR:N/UI:N). The downloaded archive yields the full site database including WordPress password hashes, which the attacker then cracks offline to obtain administrator credentials. … |
| Remediation | Vendor-released patch: update the Demi plugin to version 0.0.7 or later, which is the primary and authoritative fix per the WPScan advisory (https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, update the Demi plugin to version 0.0.7 immediately and manually audit your web server's publicly accessible paths to confirm no backup archives remain exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today