CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
Unauthenticated attackers can delete arbitrary directories on the server by exploiting exposed keys and missing path checks in the Demi WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14490?
CVE-2026-14490 is a high-severity path traversal vulnerability in deveasel Demi – One Click Demo Import, Backup & Site Migration, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.
Weakness: CWE-22
Which versions are affected by CVE-2026-14490?
How do I fix CVE-2026-14490?
No fix has been published for CVE-2026-14490 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-14490 being exploited?
There is no known exploitation of CVE-2026-14490 in the wild and no public exploit code.
Sources
Also known as GHSA-8mj8-7gxm-p63p.