Demi One Click Demo Import Backup Site Migration
Monthly
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.