CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
Unauthenticated attackers can expose restore keys to copy arbitrary files to attacker-controlled destinations on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15012?
CVE-2026-15012 is a medium-severity vulnerability in deveasel Demi – One Click Demo Import, Backup & Site Migration, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.
Weakness: CWE-200
Which versions are affected by CVE-2026-15012?
How do I fix CVE-2026-15012?
No fix has been published for CVE-2026-15012 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15012 being exploited?
There is no known exploitation of CVE-2026-15012 in the wild and no public exploit code.
Sources
Also known as GHSA-4p37-mx5p-f6gr.