External risk intelligence

RapiSafe WordPress Plugin Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-14484

The vulnerability exists in a WordPress plugin designed for public-facing contact forms. The functionality is accessible to unauthenticated visitors on any page where the contact form is rendered, making the vulnerable endpoint directly reachable over the public internet by design.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin. The flaw allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution by targeting critical configuration files. The ease of exploitation, due to exposed security tokens, presents a significant risk.

Attackers can delete server files.
Affects public-facing WordPress sites.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can target the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin to delete arbitrary files on the server, potentially leading to remote code execution. This is possible because the plugin does not properly validate file paths in its AJAX removal function. An attacker can obtain a necessary nonce from publicly visible JavaScript to trigger this deletion without needing any authentication.

No authentication required.
Unauthenticated arbitrary file deletion.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit this vulnerability to delete arbitrary files on the server. This is possible because the plugin lacks sufficient validation for file paths, and the necessary security token is exposed in public JavaScript, making it accessible to any visitor.

Arbitrary file deletion on server.
Path validation and exposed nonce.
Potential remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the RapiSafe plugin for WordPress impacts application owners responsible for the content management system and the specific plugin. The first practical step is to identify all WordPress sites using the RapiSafe plugin, assess if any are exposed to the internet and critical to business operations, and then coordinate remediation efforts with the relevant application or infrastructure teams.

Application owners must confirm usage.
Verify internet exposure and business criticality.
Plan removal or vendor-coordinated fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the RapiSafe – Secure Multi File Upload for Contact Form 7 plugin?

This is a WordPress plugin that extends the popular Contact Form 7 tool, allowing users to upload multiple files through contact forms on a website. It is typically used by site administrators to manage document submissions or media uploads from visitors directly through front-end web pages.

What does CWE-22 mean for CVE-2026-14484?

CWE-22 refers to Improper Limitation of a Pathname to a Restricted Directory, often called Path Traversal. In this CVE, the plugin fails to properly check which files are being requested for deletion. Because the software does not restrict this process to intended directories, an attacker can manipulate the path to target and delete sensitive files located anywhere on the server.

How does an attacker trigger this file deletion flaw?

An attacker triggers the bug by sending a request to the plugin’s file removal handler. They do not need a password or administrative access because the plugin relies on a security token, or nonce, that it accidentally publishes in the page's JavaScript source code. Simply having access to the webpage where the form is rendered is enough to retrieve this token and initiate the deletion command.

Is my site at risk if I use this plugin?

Halo Surface Signal indicates that because this plugin is designed for public-facing contact forms, it is very likely that your vulnerable endpoint is reachable over the internet. Any site using this plugin that displays a contact form is exposed to unauthenticated users, meaning the risk of unauthorized file deletion is high regardless of whether the site is for internal or public use.

What should I do if I have this plugin installed?

Your first step is to confirm if your WordPress site uses this specific plugin. If it is present, prioritize removing the plugin or disabling the affected functionality immediately to prevent unauthorized access. Coordinate with your technical team to audit your installation and monitor for any signs of unexpected file modifications while you work toward a secure update or replacement.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.