A critical path traversal flaw (CVSS 9.1) in the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin lets unauthenticated attackers delete arbitrary files on the server, a path that can escalate to remote code execution.
What Is It
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress fails to properly validate file paths in its handleAjaxRemoveUpload function. The result is arbitrary file deletion (CWE-22, improper limitation of a pathname to a restricted directory) reachable over the network with no authentication and no user interaction.
The nonce normally required to invoke the removal handler provides no meaningful barrier: it is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page that renders a RapiSafe upload field, making it trivially obtainable by any unauthenticated visitor.
Why It Matters
CVSS 3.1 base score is 9.1 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, with HIGH impact to both integrity and availability.
Arbitrary file deletion on a WordPress host is not merely destructive. Per the Wordfence advisory, deleting the right file, such as wp-config.php, can easily lead to remote code execution, since a WordPress instance without its config file re-enters the installation flow and can be reconfigured by an attacker. Any public-facing site running an affected version with a RapiSafe upload field on a rendered Contact Form 7 page is directly reachable.
Neither NVD nor Wordfence cites in-the-wild activity for CVE-2026-14484, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: pietror91
- Product: RapiSafe – Secure Multi File Upload for Contact Form 7 (WordPress plugin)
- Affected versions: all versions up to and including 1.0.4
- Component:
handleAjaxRemoveUploadinRSMFCF7_Assets.php/RSMFCF7_Plugin.php
Patch Status
Neither the NVD entry nor the Wordfence advisory names a fixed version. Version 1.0.4 and everything below it is affected, and the Wordfence advisory identifies no unaffected release. Operators should treat the plugin as exploitable until the vendor ships a version above 1.0.4; the practical interim option is to disable or remove the plugin.
Disclosure was published 2026-08-15 with an NVD status of "Received," meaning NVD analysis is not yet complete.
Sources
- NVD, CVE-2026-14484: https://nvd.nist.gov/vuln/detail/CVE-2026-14484
- Wordfence Threat Intelligence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/49f67bbb-cbd0-40ae-ae00-9cb72b041e22?source=cve
- WordPress Plugin Trac,
RSMFCF7_Assets.php(L201, L235, L237, L244, L264): https://plugins.trac.wordpress.org/browser/rapisafe-multi-file-cf7/trunk/src/RSMFCF7_Assets.php - WordPress Plugin Trac,
RSMFCF7_Plugin.php(L49): https://plugins.trac.wordpress.org/browser/rapisafe-multi-file-cf7/trunk/src/RSMFCF7_Plugin.php