CVE-2026-14333

The CVE concerns the Demi WordPress plugin, affected up to version 0.0.6. It stores full-site backup archives in a publicly accessible location with a predictable filename, exposing them to unauthenticated access. The impact is severe: attackers can download complete site backups, including the d...