CVE-2026-14333CWE-269privilege-escalation

CVE-2026-14333

High · published July 31, 2026

CVSS v3.1

7.5

EPSS

Percentile

33.8

In the wild

Unconfirmed

What it is

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00406 · 33.8th percentile
Weakness: CWE-269 · Improper Privilege Management
Published: 2026-07-31T11:16Z

References (1)

https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/ · [email protected]

EPSS history

Timeline

31 JUL 06:00Z
Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
cvelistv5