CVE-2026-14333 affects the Demi WordPress plugin prior to version 0.0.7. The plugin stores full-site backup archives in a publicly accessible location under predictable filenames without any access controls. This improper privilege management vulnerability enables unauthenticated attackers to download full backups, which include sensitive data such as the site database and user password hashes. The vulnerability is categorized under CWE-269 and has a CVSS 3.1 base score of 7.5, indicating high severity. There is no official remediation or patch available as per the current data, and no known exploits in the wild have been reported.

An attacker can access and download complete site backups without authentication, exposing sensitive information including the site database and user password hashes. This could lead to further compromise of the site or user accounts if the password hashes are cracked. The vulnerability does not affect the integrity or availability directly but compromises confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to backup storage locations by implementing manual access controls or removing publicly accessible backups. Monitor for updates from the plugin vendor regarding patches or official mitigations.