{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/the-demi/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-14490"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Demi – One Click Demo Import, WP Backup \u0026 Site Migration plugin \u003c= 0.0.7"],"_cs_severities":["medium"],"_cs_tags":["wordpress","plugin-vulnerability","arbitrary-deletion","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["The Demi"],"content_html":"\u003cp\u003eCVE-2026-14490 describes a critical vulnerability affecting all versions up to 0.0.7 of The Demi - One Click Demo Import, WP Backup \u0026amp; Site Migration plugin for WordPress. This flaw, with a CVSS v3.1 Base Score of 7.5, allows unauthenticated attackers to recursively delete arbitrary directories on the server hosting the WordPress instance. The vulnerability stems from the plugin's insecure storage of its HMAC signing key and per-step restore token as dotfiles within a publicly accessible subdirectory of the WordPress uploads folder, without adequate protection such as \u003ccode\u003e.htaccess\u003c/code\u003e or index files. An unauthenticated attacker can retrieve this key, then use it to forge a valid signed state envelope for the \u003ccode\u003edemi_restore_step\u003c/code\u003e AJAX handler. This handler explicitly accepts the on-disk signing key as an alternative to standard WordPress authentication checks and processes a caller-supplied absolute path for deletion without validation or allow-listing. The exploitation of this vulnerability can lead to severe data loss and denial of service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a WordPress site running The Demi - One Click Demo Import, WP Backup \u0026amp; Site Migration plugin version 0.0.7 or earlier.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a direct HTTP GET request to a known publicly accessible subdirectory within the WordPress uploads folder (e.g., \u003ccode\u003e/wp-content/uploads/demi-backup/\u003c/code\u003e) to locate and retrieve the exposed \u003ccode\u003e.hmac_key\u003c/code\u003e dotfile.\u003c/li\u003e\n\u003cli\u003eThe web server, lacking proper \u003ccode\u003e.htaccess\u003c/code\u003e or index file protection for the directory, serves the \u003ccode\u003e.hmac_key\u003c/code\u003e file, allowing the attacker to obtain the HMAC signing key.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the retrieved HMAC signing key to craft a malicious POST request to the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint, setting the \u003ccode\u003eaction\u003c/code\u003e parameter to \u003ccode\u003edemi_restore_step\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin the POST request, the attacker includes a forged signed state envelope containing the stolen HMAC key and a \u003ccode\u003epath\u003c/code\u003e parameter specifying an absolute path to an arbitrary target directory on the server (e.g., \u003ccode\u003e/var/www/html\u003c/code\u003e, \u003ccode\u003e/etc\u003c/code\u003e, or \u003ccode\u003e/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003edemi_restore_step\u003c/code\u003e AJAX handler processes the request, bypassing authentication checks due to the valid forged envelope.\u003c/li\u003e\n\u003cli\u003eThe handler invokes the \u003ccode\u003eCleanDir::execute()\u003c/code\u003e function with the attacker-supplied absolute path, which is not subjected to allow-listing or path canonicalization checks.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eCleanDir::execute()\u003c/code\u003e function recursively deletes the specified arbitrary directory on the server, resulting in data destruction, site defacement, or complete denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14490 allows unauthenticated attackers to recursively delete any directory on the compromised server. This can lead to catastrophic consequences, including complete deletion of the WordPress installation files, sensitive configuration files, other website data, or even critical operating system directories. The primary observed impacts include severe data loss, web application defacement, and extended denial of service for the affected WordPress instance and potentially the entire server. Organizations face significant operational disruption and recovery costs if an attacker targets their essential system directories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update The Demi - One Click Demo Import, WP Backup \u0026amp; Site Migration plugin to a patched version to remediate CVE-2026-14490.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual requests to dotfiles (e.g., \u003ccode\u003e.hmac_key\u003c/code\u003e) within publicly accessible directories like \u003ccode\u003e/wp-content/uploads/demi-backup/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to detect and block requests attempting to access sensitive dotfiles or sending POST requests to \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e with suspicious \u003ccode\u003edemi_restore_step\u003c/code\u003e actions and absolute paths in the \u003ccode\u003epath\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eEnsure proper file system permissions and web server configurations are in place to prevent direct access to sensitive configuration files or dotfiles, especially in \u003ccode\u003e/wp-content/uploads/\u003c/code\u003e and its subdirectories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T07:18:47Z","date_published":"2026-07-28T07:18:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-demi-plugin-deletion/","summary":"Unauthenticated attackers can exploit CVE-2026-14490 in The Demi - One Click Demo Import, WP Backup \u0026 Site Migration WordPress plugin (versions up to and including 0.0.7) to achieve arbitrary directory deletion by retrieving a publicly exposed HMAC signing key and forging valid requests to a vulnerable AJAX handler.","title":"The Demi WordPress Plugin Vulnerable to Arbitrary Directory Deletion (CVE-2026-14490)","url":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-demi-plugin-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - The Demi","version":"https://jsonfeed.org/version/1.1"}