Threats Tagged 'cve-2026-15012'
View all threats tagged with 'cve-2026-15012'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-15012'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-15012: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in deveasel Demi – One Click Demo Import, Backup & Site MigrationCVE-2026-15012 0 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. Join the discussion | CVE Database V5 | 07/28/2026, 05:39:42 UTC Added: 07/28/2026, 06:37:36 UTC |
Showing 1 to 1 of 1 result