CVE-2026-14487 is a critical path traversal vulnerability (CWE-22) in the Simple Coherent Form plugin for WordPress, affecting all versions up to and including 2.4.13. The vulnerability arises from insufficient file path validation in the removeUploadDir function, enabling arbitrary file deletion. Additionally, the scf_get_id_upload endpoint issues a valid file removal nonce to any unauthenticated user, and the secondary hash check used for authorization is forgeable offline due to reliance on a hardcoded salt in the plugin source code. These flaws eliminate effective authorization boundaries, allowing unauthenticated attackers to delete arbitrary files, potentially leading to remote code execution if key files like wp-config.php are removed.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can result in denial of service or remote code execution if critical files such as wp-config.php are deleted. The vulnerability has a CVSS 3.1 score of 9.1, indicating a critical severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin endpoints and consider disabling or removing the Simple Coherent Form plugin if possible to prevent exploitation.