What is the CVSS score of EUVD-2026-51409?

EUVD-2026-51409 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Demi are affected by EUVD-2026-51409?

The Demi WordPress plugin before version 0.0.7 allows unauthenticated attackers to access complete site backup archives containing WordPress user password hashes through publicly available exploit…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51409?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51409. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-51409?

Within 24 hours, update the Demi plugin to version 0.0.7 immediately and manually audit your web server's publicly accessible paths to confirm no backup archives remain exposed. Within 7 days, review WordPress administrator and user account access logs for suspicious activity; reset all administrative user passwords as a precaution and verify no unauthorized accounts were created during the exposure window. Within 30 days, implement web application firewall rules to block direct requests to backup directories, configure server-side access controls to restrict backup archive visibility, and establish file-permission audits to prevent similar exposures in future deployments.

Demi EUVD-2026-51409

| CVE-2026-14333 HIGH

Improper Privilege Management (CWE-269)

2026-07-31 WPScan

GHSA-q89r-49r9-5hmx

WordPress Privilege Escalation Demi Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote GET of an unprotected backup (AV:N/AC:L/PR:N/UI:N) fully discloses the database, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:23 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.

Technical ContextAI

Demi is a backup-oriented plugin for WordPress, the PHP/MySQL content-management platform that powers a large share of public websites. The flaw stems from where and how the plugin persists its output: full-site backup archives are placed inside the web-servable directory tree (typically under wp-content) using a guessable, non-randomized filename and without an .htaccess deny rule, index guard, or authentication check. The assigned CWE-269 (Improper Privilege Management) and the 'Privilege Escalation' tag describe the downstream effect - captured password hashes enable account escalation - but the root cause is really unauthenticated exposure of sensitive files (information disclosure, akin to CWE-200/CWE-538). The CPE is recorded generically as cpe:2.3:a:unknown:demi:*:*:*:*:*:*:*:*, so the vendor is not authoritatively identified in NVD.

RemediationAI

Vendor-released patch: update the Demi plugin to version 0.0.7 or later, which is the primary and authoritative fix per the WPScan advisory (https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/). Because backups already written by vulnerable versions remain exposed, also delete any existing backup archives from the web-accessible directory and rotate all affected secrets - force a password reset for every WordPress account and change database credentials and any API keys stored in the backup, since the hashes may already have been exfiltrated. As interim compensating controls before patching, block web access to the plugin's backup directory with a server rule (e.g. an .htaccess 'Deny from all' or an nginx location deny) or move backups outside the web root; note the trade-off that this can break the plugin's own restore/download functionality. Deactivating the Demi plugin entirely removes the exposure but disables its backup capability.