CVE-2026-14333
Received Received - Intake

Demi WordPress Plugin Full-Site Backup Exposure

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14333
EUVD
EUVD-2026-51409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
demi wordpress_plugin to 0.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Demi WordPress plugin before version 0.0.7 stores full-site backup archives in a publicly accessible directory with predictable filenames and no access protection. This allows unauthenticated attackers to download complete backups, including the site database and user password hashes.

Detection Guidance

Check if the Demi WordPress plugin is installed and verify its version. If it is below 0.0.7, the vulnerability likely exists. Look for publicly accessible backup files in the plugin's directory, such as predictable filenames like backup-*.zip in the wp-content/uploads/demi-backup/ folder.

Impact Analysis

Attackers could access sensitive data like user passwords and database contents. This may lead to account takeovers, data breaches, or further exploitation of the compromised site.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy, such as GDPR and HIPAA, due to unauthorized access to sensitive user data and potential data breaches.

Mitigation Strategies

Update the Demi WordPress plugin to version 0.0.7 or later immediately. Remove any existing backup files from publicly accessible directories. Ensure all sensitive data, including user password hashes, is secured by resetting passwords after the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart