CVE-2026-14490
Received Received - Intake

Arbitrary Directory Deletion in Demi – One Click Demo Import WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-14490
EUVD
EUVD-2026-49692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
demi one_click_demo_import to 0.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows unauthenticated attackers to delete arbitrary directories on the server. The plugin stores sensitive keys in a publicly accessible folder without protection. An attacker can retrieve these keys and forge requests to delete any directory, including critical system files.

Detection Guidance

Check for exposed dotfiles in the WordPress uploads folder, particularly those related to the Demi plugin. Look for files like .demi_hmac_key or similar in publicly accessible subdirectories. Use commands like 'find /path/to/uploads -name ".*demi*" -type f' to locate them.

Impact Analysis

An attacker could delete important files, including backups, website content, or system directories. This could crash your website, cause data loss, or allow further attacks. The vulnerability requires no authentication, making it easy for attackers to exploit remotely.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to delete backups or critical files, violating GDPR or HIPAA requirements for data integrity and availability. Organizations may face compliance fines if exploited.

Mitigation Strategies

Immediately update the Demi plugin to the latest version if available. If not, disable and remove the plugin. Restrict access to the uploads directory by adding an .htaccess file or index.php to block direct access. Review server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart