CVE-2026-15012: Demi WordPress Plugin Path Traversal Flaw

CVE-2026-15012 Overview

CVE-2026-15012 affects the Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress in all versions up to and including 0.0.8. The vulnerability allows unauthenticated attackers to copy arbitrary directories to attacker-controlled destinations on the server through the handle_restore_step function. The flaw stems from missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes cryptographic material used for restore-state authentication. Exploitation requires an active restore operation to have been initiated on the target site, which writes the .restore_key and .restore_step_token files to the public upload directory.

Critical Impact
Unauthenticated attackers can harvest exposed cryptographic secrets and chain them to forge signed restore-state envelopes, enabling arbitrary file copy operations on affected WordPress sites.

Affected Products

Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress
All versions up to and including 0.0.8
WordPress sites running the demi-backup-migration plugin

Discovery Timeline

2026-07-28 - CVE-2026-15012 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15012

Vulnerability Analysis

The vulnerability resides in the plugin's restore workflow, specifically the handle_restore_step function within the Import Manager class. The plugin implements an unauthenticated AJAX handler intended to be authenticated using a cryptographic restore key. However, the key file itself is written into a publicly accessible directory beneath wp-content/uploads/, without HTTP access controls such as an .htaccess deny rule or web-server-level restrictions.

During an active restore operation, the plugin writes .restore_key and .restore_step_token files into wp-content/uploads/demi-backup-state/. Any unauthenticated remote client can fetch these files directly over HTTP. Once retrieved, the secrets can be used to forge signed restore-state envelopes accepted by the AJAX handler, driving the restore state machine to invoke arbitrary directory copy operations. The issue is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Root Cause

The root cause is the placement of authentication secrets in a web-accessible location without corresponding access restrictions. The plugin conflates "filesystem-only" state material with "web-served" upload content by using the shared uploads directory. Because the AJAX handler treats possession of the restore key as proof of authorization, any actor who can read the key bypasses the entire authentication model.

Attack Vector

Exploitation is remote and unauthenticated but conditional on timing. An attacker must reach the target site while a restore operation is in progress, at which point the .restore_key and .restore_step_token files exist under demi-backup-state/. The attacker fetches both files, computes valid signatures for restore-step payloads, and invokes the vulnerable handler to trigger directory copy actions to attacker-chosen destinations. With an EPSS score of 0.317%, opportunistic mass exploitation is unlikely, but targeted abuse during migrations is plausible. See the Wordfence Vulnerability Report and the WordPress Import Manager Code for the vulnerable code paths.

Detection Methods for CVE-2026-15012

Indicators of Compromise

HTTP GET requests to /wp-content/uploads/demi-backup-state/.restore_key or .restore_step_token from external IP addresses.
Unexpected files or directories appearing under WordPress install paths outside the plugin's normal restore targets.
AJAX requests to the plugin's restore-step endpoint originating from IP addresses not associated with site administrators.
Presence of the demi-backup-state/ directory persisting after a restore operation should have completed.

Detection Strategies

Monitor web server access logs for direct requests to hidden dotfiles under wp-content/uploads/demi-backup-state/.
Alert on AJAX invocations of the plugin's handle_restore_step action from unauthenticated sessions.
Track filesystem changes on the WordPress host during and after any restore operation to identify unexpected copy destinations.

Monitoring Recommendations

Enable file integrity monitoring on WordPress installation directories and wp-content/ subtrees.
Ingest WordPress and web server logs into a centralized platform for cross-correlation of restore activity with external HTTP fetches.
Review plugin inventory across managed WordPress sites to identify installations of demi-backup-migration at version 0.0.8 or earlier.

How to Mitigate CVE-2026-15012

Immediate Actions Required

Deactivate the Demi – One Click Demo Import, WP Backup & Site Migration plugin on all sites still running version 0.0.8 or earlier until a patched release is confirmed installed.
Delete any residual wp-content/uploads/demi-backup-state/ directory left behind by prior restore operations.
Restrict HTTP access to the demi-backup-state/ directory at the web server layer using .htaccess, nginx location blocks, or WAF rules.
Audit the WordPress filesystem for unauthorized directory copies performed while a restore was active.

Patch Information

A plugin update addressing the exposure is tracked in the WordPress Changeset Overview. Site operators should upgrade to a version later than 0.0.8 once available and validate that restore-state material is written outside of publicly served directories. Refer to the Wordfence Vulnerability Report for advisory updates.

Workarounds

Add a web server rule that denies HTTP access to any file matching .restore_key or .restore_step_token beneath wp-content/uploads/.
Move or symlink the demi-backup-state/ directory outside of the web-served document root during restore operations.
Perform restore operations only from maintenance windows during which the site is behind an IP allowlist or maintenance-mode gate.

bash

# Apache .htaccess snippet to block access to restore state files
<FilesMatch "^\.restore_(key|step_token)$">
    Require all denied
</FilesMatch>

# nginx equivalent
location ~ /wp-content/uploads/demi-backup-state/ {
    deny all;
    return 403;
}