The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss and privilege escalation due a missing capability check on the Ajax::handle_request() function in all versions up to, including, 2.0.8. This makes it possible authenticated attackers, with Subscriber-level access above, trigger full site reset, dropping database tables except users/usermeta re-running wp_install(), which also assigns Administrator role attacking subscriber account.