PatchSiren cyber security CVE debrief
CVE-2026-14484 pietror91 CVE debrief
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor. Evidence from the NVD and Wordfence indicates a critical vulnerability in the RapiSafe plugin. However, details about the vendor and affected scope are limited. Defenders should verify the affected versions, review server logs for suspicious file deletion activity, and implement additional monitoring for changes to critical files. The vulnerability has a CVSS score of 9.1 and is considered critical. WordPress administrators using the RapiSafe plugin, security teams monitoring for potential file deletion attacks, and developers of WordPress plugins should be aware of this critical vulnerability.
- Vendor
- pietror91
- Product
- RapiSafe – Secure Multi File Upload for Contact Form 7
- CVSS
- CRITICAL 9.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-15
- Original CVE updated
- 2026-08-15
- Advisory published
- 2026-08-15
- Advisory updated
- 2026-08-15
Who should care
WordPress administrators using the RapiSafe plugin, security teams monitoring for potential file deletion attacks, and developers of WordPress plugins should be aware of this critical vulnerability. They should review their deployments, update to a version beyond 1.0.4, and implement additional monitoring for changes to critical files.
Technical summary
The RapiSafe plugin for WordPress has a critical vulnerability (CVE-2026-14484) allowing arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This could lead to remote code execution if a critical file like wp-config.php is deleted. The vulnerability has a CVSS score of 9.1 and is considered critical. The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.
Defensive priority
High priority due to critical CVSS score of 9.1 and potential for remote code execution.
Recommended defensive actions
- Immediately update the RapiSafe plugin to a version beyond 1.0.4.
- Review server logs for suspicious file deletion activity.
- Implement additional monitoring for changes to critical files.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The RapiSafe plugin for WordPress has a critical vulnerability (CVE-2026-14484) allowing arbitrary file deletion due to insufficient file path validation. Evidence from the NVD and Wordfence indicates a critical vulnerability in the RapiSafe plugin. However, details about the vendor and affected scope are limited. Defenders should verify the affected versions, review server logs for suspicious file deletion activity, and implement additional monitoring for changes to critical files.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T03:16:47.263Z and has not been modified since then.