CVE-2026-14333 — Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Ba…

CVE-2026-14333

Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory PUBLISHED

Description (CNA)

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

Affected (CNA)

Vendor / product	Versions
Unknown / Demi	affected 0 before 0.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.