CVE-2026-15012
Received Received - Intake

Arbitrary Directory Copy in Demi – One Click Demo Import WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-15012
EUVD
EUVD-2026-49691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
demi one_click_demo_import to 0.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. It occurs due to missing HTTP access controls on a specific directory, exposing cryptographic restore keys that can be used to forge restore-state envelopes and authenticate an unauthenticated AJAX handler.

Detection Guidance

Check for unauthorized files in the wp-content/uploads/demi-backup-state/ directory. Look for .restore_key and .restore_step_token files which indicate active restore operations. Use commands like 'find /var/www/html/wp-content/uploads/demi-backup-state/ -type f -name ".restore_*"' to locate them.

Impact Analysis

An attacker could exploit this to overwrite critical files, inject malicious code, or gain control of the WordPress site. This could lead to site defacement, data theft, or further compromise of the server hosting the site.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR and HIPAA requirements for data integrity and confidentiality. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately delete the wp-content/uploads/demi-backup-state/ directory if it exists. Disable the Demi – One Click Demo Import plugin until a patch is released. Monitor server logs for suspicious file copy operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart