CVE-2026-14484 is a path traversal vulnerability (CWE-22) in the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin. The vulnerability arises from insufficient validation of file paths in the handleAjaxRemoveUpload function, allowing unauthenticated attackers to delete arbitrary files on the server. The nonce required to invoke this function is exposed in public JavaScript variables on pages rendering the upload field, enabling any unauthenticated visitor to obtain it and exploit the vulnerability. This can lead to remote code execution by deleting critical files such as wp-config.php. The vulnerability affects all versions up to and including 1.0.4. No official patch or remediation level has been published as of the data provided.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable WordPress plugin. This can cause denial of service or enable remote code execution if critical files like wp-config.php are deleted. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with high impact on integrity and availability without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor pietror91 regarding patches or official mitigations. Avoid exposing the nonce in public JavaScript or implement additional server-side validation to prevent arbitrary file deletion.