CVE-2026-15012 is a vulnerability in the Demi – One Click Demo Import, Backup & Site Migration WordPress plugin that allows unauthenticated arbitrary file copy via the handle_restore_step function. The root cause is missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes a cryptographic restore key used to authenticate an AJAX handler. Attackers can harvest this key and forge signed restore-state envelopes to copy files to attacker-controlled locations. Exploitation requires an active restore operation that writes sensitive files (.restore_key and .restore_step_token) to the public upload directory. No patch or official remediation has been confirmed yet.

The vulnerability enables unauthenticated attackers to copy arbitrary files to locations they control on the server, potentially leading to unauthorized file manipulation. There is no direct confidentiality impact reported, but integrity is affected due to the ability to write files arbitrarily. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the wp-content/uploads/demi-backup-state/ directory by implementing appropriate HTTP access controls or disabling the restore functionality if possible. Monitor for active restore operations and limit exposure of sensitive files in public directories.