CVE-2026-14484 is a path traversal vulnerability (CWE-22) in the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin, affecting all versions up to and including 1.0.4. The vulnerability arises from insufficient validation of file paths in the handleAjaxRemoveUpload function, allowing unauthenticated attackers to delete arbitrary files on the server. The nonce required to invoke this deletion handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it accessible to any unauthenticated visitor. Deleting critical files like wp-config.php can lead to remote code execution. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on integrity and availability.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin by exploiting insufficient path validation and publicly exposed nonce. This can lead to remote code execution if critical files such as wp-config.php are deleted, severely impacting the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it to prevent exploitation. Monitor for updates from the vendor pietror91 regarding patches or official fixes.