CVE-2026-14484 pietror91 CVE debrief

Who should care

WordPress administrators using the RapiSafe plugin, security teams monitoring for potential file deletion attacks, and developers of WordPress plugins should be aware of this critical vulnerability. They should review their deployments, update to a version beyond 1.0.4, and implement additional monitoring for changes to critical files.

Technical summary

The RapiSafe plugin for WordPress has a critical vulnerability (CVE-2026-14484) allowing arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This could lead to remote code execution if a critical file like wp-config.php is deleted. The vulnerability has a CVSS score of 9.1 and is considered critical. The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.

Defensive priority

High priority due to critical CVSS score of 9.1 and potential for remote code execution.

Recommended defensive actions

• Immediately update the RapiSafe plugin to a version beyond 1.0.4.
• Review server logs for suspicious file deletion activity.
• Implement additional monitoring for changes to critical files.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The RapiSafe plugin for WordPress has a critical vulnerability (CVE-2026-14484) allowing arbitrary file deletion due to insufficient file path validation. Evidence from the NVD and Wordfence indicates a critical vulnerability in the RapiSafe plugin. However, details about the vendor and affected scope are limited. Defenders should verify the affected versions, review server logs for suspicious file deletion activity, and implement additional monitoring for changes to critical files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.