Threats tagged 'ghsa-q89r-49r9-5hmx'

The Demi WordPress plugin versions before 0.0.7 improperly manage privileges by storing full-site backup archives in a publicly accessible location with predictable filenames and no access protection. This allows unauthenticated attackers to download complete backups, including the site database and user password hashes. The vulnerability is classified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 7.5.