CVE-2026-14484: RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RapiSafe – Secure Multi File Upload for Contact Form 7 (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.0.4 - Compensating control
Because the removal handler nonce is exposed publicly as RSMFCF7Vars.nonce on every page rendering a RapiSafe upload field, restrict access to the affected Contact Form 7/RapiSafe endpoints (and any related AJAX handler for handleAjaxRemoveUpload) so that only trusted users/sessions can invoke arbitrary file removal.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14484?
CVE-2026-14484 is rated as critical with a severity score of 9.1.
How do I fix CVE-2026-14484?
To fix CVE-2026-14484, update the RapiSafe plugin to the latest version beyond 1.0.4.
What vulnerabilities are associated with CVE-2026-14484?
CVE-2026-14484 is associated with insufficient file path validation, allowing unauthenticated arbitrary file deletion.
Who is affected by CVE-2026-14484?
All users of the RapiSafe plugin for WordPress versions up to and including 1.0.4 are affected by CVE-2026-14484.
What kind of attack can occur from CVE-2026-14484?
CVE-2026-14484 allows unauthenticated attackers to delete arbitrary files on the server.