CVE-2026-14490

The CVE concerns the Demi – One Click Demo Import, WP Backup & Site Migration WordPress plugin. All versions up to 0.0.7 are affected due to the plugin storing its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible uploads subdirectory without protection. The una...