CVE-2026-14484
Received Received - Intake

Arbitrary File Deletion in RapiSafe Secure Multi File Upload for Contact Form 7

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-14484
EUVD
EUVD-2026-58835

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rapisafe secure_multi_file_upload_for_contact_form_7 to 1.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the RapiSafe plugin for WordPress. It allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation in the handleAjaxRemoveUpload function. The required nonce is exposed in public-facing JavaScript, making it accessible to any visitor.

Detection Guidance

Check for unauthorized file deletions in server logs, particularly around Contact Form 7 pages. Look for requests to the handleAjaxRemoveUpload function or unusual activity in wp-content/uploads. No specific commands are provided in the context.

Impact Analysis

An attacker could delete critical files like wp-config.php, leading to remote code execution. This could compromise the entire WordPress site, allowing unauthorized access, data theft, or site defacement. The impact is severe due to the potential for full server control.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance breaches may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the RapiSafe plugin to the latest version if available. If not, disable the plugin immediately. Restrict file deletion permissions and monitor for suspicious activity. Review server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14484. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart