CVE-2026-14484

Name of the Vulnerable Software and Affected Versions RapiSafe – Secure Multi File Upload for Contact Form 7 versions prior to 1.0.5

Description Insufficient file path validation in the handleAjaxRemoveUpload() function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are deleted. The required nonce is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on any Contact Form 7 page that renders a RapiSafe upload field, allowing any visitor to obtain it. The attack involves the rsmfcf7 session and file name parameters.

Recommendations Update RapiSafe – Secure Multi File Upload for Contact Form 7 to version 1.0.5 or later. As a temporary workaround, restrict access to the handleAjaxRemoveUpload() function to minimize the risk of exploitation.