WordPress Plugin Stores Backups in Publicly Accessible Location

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Demi WordPress plugin before version 0.0.7 contains a critical vulnerability in how it handles full-site backup archives. The plugin generates backup files containing sensitive data—including the complete site database and user password hashes—and stores them in a web-accessible directory using predictable filenames without any access controls. This means any unauthenticated attacker can simply guess or enumerate the backup file locations and download them directly, gaining immediate access to database credentials, user accounts, and other sensitive configuration data. WordPress site administrators using this plugin are particularly at risk, as they may be unaware that their most sensitive data is publicly exposed through a single plugin misconfiguration.

Casky's 224 matching skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns behind this vulnerability by mapping it to MITRE ATT&CK technique TA0004 (Reconnaissance). Practitioners using Casky would observe findings related to unauthenticated information disclosure and credential exposure patterns. The platform's skills would identify the telltale signs: unprotected backup files in predictable locations (such as `/wp-content/backups/` or similar directories), absence of authentication checks on archive downloads, and the presence of database dumps containing password hashes. Security teams analyzing this vulnerability through Casky would see detection rules flagging HTTP requests to common backup file patterns, directory traversal attempts targeting backup locations, and downloads of unusually large files containing database structures—enabling them to identify both active exploitation attempts and vulnerable plugin instances before attackers can access their complete site backups.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14333.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14333

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14333. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn