CVE-2026-14333: Demi WordPress Plugin Backup Disclosure

CVE-2026-14333 Overview

CVE-2026-14333 affects the Demi WordPress plugin in versions prior to 0.0.7. The plugin writes full-site backup archives to a publicly accessible location using a predictable filename and applies no access protection. Unauthenticated remote attackers can request these archives directly and download complete site backups, including the WordPress database and stored user password hashes. The issue is classified under [CWE-269] (Improper Privilege Management) and is scored 7.5 on the CVSS v3.1 scale. Recovered password hashes enable offline cracking, and exposed database contents provide attackers with post-authentication footholds, secrets, and personally identifiable information stored by the site.

Critical Impact
Unauthenticated attackers can retrieve complete WordPress site backups containing database contents and user password hashes without any interaction with legitimate users.

Affected Products

Demi WordPress plugin versions prior to 0.0.7
WordPress installations that have activated the Demi plugin
Any site whose Demi backup archives remain in the default output location

Discovery Timeline

2026-07-31 - CVE-2026-14333 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14333

Vulnerability Analysis

The Demi plugin generates full-site backup archives as part of its normal operation. These archives are stored inside a directory that is reachable over HTTP or HTTPS from the public web root. The archive filenames follow a predictable naming pattern, so an attacker does not need to guess a high-entropy token to locate a backup. Because no authentication check, access control rule, or index protection is applied to the storage location, requesting the archive URL returns the file directly. The archive contains the full WordPress database, including the wp_users table with user_pass hashes generated by WordPress. Attackers can extract these hashes and run offline cracking against them. The archive also exposes wp-config.php values, secret keys, API tokens, and any content stored in the database.

Root Cause

The root cause is improper privilege management [CWE-269] combined with predictable resource placement. The plugin trusts that files placed in its output directory will not be discovered, rather than enforcing an access control decision on each request. No .htaccess deny rule, randomized path segment, or authentication wrapper protects the archives.

Attack Vector

Exploitation requires only network access to the target site. An attacker enumerates the predictable backup path, issues an unauthenticated HTTP GET request for the archive, and receives the file. No user interaction, session, or elevated privileges are required. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-14333

Indicators of Compromise

Unauthenticated HTTP GET requests targeting the Demi plugin's backup output directory under wp-content/
Successful 200 OK responses returning large archive files (.zip, .tar.gz, or similar) to external IP addresses
Repeated directory enumeration attempts against paths associated with the Demi plugin
Unexpected outbound password-cracking activity following external archive downloads

Detection Strategies

Review web server access logs for requests to Demi plugin backup paths originating from IPs that never authenticated to wp-admin
Alert on any response over a defined size threshold served from wp-content/plugins/ or plugin-managed upload directories
Correlate backup archive downloads with subsequent credential-stuffing or login attempts against the same site

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and baseline normal traffic to wp-content/ paths
Monitor filesystem changes that create new archive files in web-accessible directories
Track the installed version of the Demi plugin across managed WordPress fleets and flag any host running a version below 0.0.7

How to Mitigate CVE-2026-14333

Immediate Actions Required

Update the Demi WordPress plugin to version 0.0.7 or later on every affected site
Delete any existing backup archives from public directories and move them to storage outside the web root
Rotate all WordPress user passwords and invalidate active sessions, assuming password hashes may have been exposed
Rotate secrets stored in wp-config.php, including database credentials, AUTH_KEY, and any API tokens present in the database

Patch Information

The vendor addressed the issue in Demi plugin version 0.0.7. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin directory with the fixed release. Confirm the fix by verifying that backup archives are no longer stored in a publicly reachable directory. Additional details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the Demi plugin until the site can be upgraded to version 0.0.7 or later
Add web server rules that deny direct HTTP access to the plugin's backup directory
Relocate existing backup archives to a location outside the web root and restrict filesystem permissions

bash

# Apache: block direct access to Demi backup archives
<FilesMatch "\.(zip|tar|tar\.gz|sql)$">
    Require all denied
</FilesMatch>

# Nginx: deny access to the plugin's backup output directory
location ~* /wp-content/.*/demi/.*\.(zip|tar|tar\.gz|sql)$ {
    deny all;
    return 403;
}