Demi One Click Demo Import Backup Site Migration
Monthly
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
We need to produce a comprehensive JSON output based on the provided CVE data and instructions. The user gave us a specific CVE ID with description, CVSS, CWE, tags, references, etc. We must synthesize using ALL provided data, not just parrot description. The output fields are heavily specified. Let's extract key info. CVE-2026-15012: "Demi - One Click Demo Import, WP Backup & Site Migration" plugin for WordPress. Vulnerable to Arbitrary Directory Copy via handle_restore_step. Missing HTTP access controls on wp-content/uploads/demi-backup-state/ directory exposes cryptographic restore key used to authenticate unauthenticated AJAX handler and forge signed restore-state envelopes. So unauthenticated attackers can copy arbitrary files to attacker-controlled destinations. But an active restore operation must have been initiated, which writes .restore_key and .restore_step_token files to the public upload directory. So there's a prerequisite: an active restore operation. The CVSS is 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning network, low complexity, no privileges, no user interaction, scope unchanged, no confidentiality impact, low integrity, no availability. CWE-200: Information Disclosure (exposure of sensitive info to unauthorized actor). The description mentions missing access controls on a directory that exposes secrets, then these secrets allow unauthenticated arbitrary file copy. So the core issue is information disclosure (exposure of keys), which then enables integrity impact (arbitrary file copy). So the CVSS might be underrated because the final impact is file copy, but the CVSS base score only counts the immediate exposure? But the CVSS is provided, we might need to assess independently? The task: "assessed_cvss_vector" and "assessed_cvss40_vector" are our own independent CVSS vector. So we must produce a vector based on the description, not copy the provided one. The description: unauthenticated attacker can access wp-content/uploads/demi-back
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
We need to produce a comprehensive JSON output based on the provided CVE data and instructions. The user gave us a specific CVE ID with description, CVSS, CWE, tags, references, etc. We must synthesize using ALL provided data, not just parrot description. The output fields are heavily specified. Let's extract key info. CVE-2026-15012: "Demi - One Click Demo Import, WP Backup & Site Migration" plugin for WordPress. Vulnerable to Arbitrary Directory Copy via handle_restore_step. Missing HTTP access controls on wp-content/uploads/demi-backup-state/ directory exposes cryptographic restore key used to authenticate unauthenticated AJAX handler and forge signed restore-state envelopes. So unauthenticated attackers can copy arbitrary files to attacker-controlled destinations. But an active restore operation must have been initiated, which writes .restore_key and .restore_step_token files to the public upload directory. So there's a prerequisite: an active restore operation. The CVSS is 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning network, low complexity, no privileges, no user interaction, scope unchanged, no confidentiality impact, low integrity, no availability. CWE-200: Information Disclosure (exposure of sensitive info to unauthorized actor). The description mentions missing access controls on a directory that exposes secrets, then these secrets allow unauthenticated arbitrary file copy. So the core issue is information disclosure (exposure of keys), which then enables integrity impact (arbitrary file copy). So the CVSS might be underrated because the final impact is file copy, but the CVSS base score only counts the immediate exposure? But the CVSS is provided, we might need to assess independently? The task: "assessed_cvss_vector" and "assessed_cvss40_vector" are our own independent CVSS vector. So we must produce a vector based on the description, not copy the provided one. The description: unauthenticated attacker can access wp-content/uploads/demi-back