CVE-2026-14487 is a path traversal vulnerability (CWE-22) in the Simple Coherent Form WordPress plugin by tombgtn. The vulnerability arises from insufficient file path validation in the removeUploadDir function, allowing unauthenticated attackers to delete arbitrary files. The scf_get_id_upload endpoint issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the secondary hash check is forgeable offline due to a hardcoded salt in the plugin source. This lack of effective authorization enables attackers to delete files such as wp-config.php, potentially leading to remote code execution. The vulnerability affects all versions up to and including 2.4.13. No official patch or remediation has been confirmed as of the publication date.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can result in denial of service or remote code execution if critical files (e.g., wp-config.php) are deleted. The vulnerability compromises the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoints and consider disabling the Simple Coherent Form plugin if possible. Monitor for updates from the vendor or trusted security sources.