Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-14490

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explici
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d411a1759cdfae520d9883351e28fc2254f0943d347153da1520b99da3cca188
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"Demi – One Click Demo Import, Backup & Site Migration","vendor":"deveasel","versions":[{"lessThanOrEqual":"0.0.7","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/problemTypes/0/descriptions/0

Source references

10 source assertions
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Backup/Tasks/CleanDir.php#L61"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php#L287"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/8
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php#L50"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/7
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/tags/0.0.6/classes/Import/Manager.php#L767"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Backup/Tasks/CleanDir.php#L61"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Import/Manager.php#L287"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Import/Manager.php#L50"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/demi-backup-migration/trunk/classes/Import/Manager.php#L767"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3616690%40demi-backup-migration&new=3616690%40demi-backup-migration"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/9
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63922c28-0cb5-4abe-85ee-20b2cc6f015d?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:42ebd9b1db417c8472b416a64a09c948e5fa457380c1b76c33171ef4d05ced26 · sha256:ba602bc68d6aebaf… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer