RapiSafe Contact Form 7 Plugin Unauthenticated Arbitrary File Deletion

Technical Analysis

CVE-2026-14484 (CVSS 9.1) stems from insufficient file path validation in the handleAjaxRemoveUpload function, allowing attackers to specify arbitrary file paths for deletion via crafted AJAX requests. The required security nonce (RSMFCF7Vars.nonce) is embedded in publicly rendered JavaScript on any page containing a RapiSafe upload field, eliminating the need for authentication or session hijacking. Deleting wp-config.php forces WordPress into a fresh-install state, enabling attackers to define a new database connection and admin account, achieving full remote code execution. This is a classic WordPress plugin file-handling flaw rather than a memory-corruption or supply-chain compromise, but its impact is equivalent to full site compromise. Organizations running AI agents or automation pipelines that manage WordPress content, forms, or CMS integrations via API keys stored in wp-config.php should treat this as agent-relevant, since a successful exploit could expose database credentials, API keys, and any secrets used by agent-driven content or form-processing workflows.

Affected Systems

WordPress installations using the RapiSafe – Secure Multi File Upload for Contact Form 7 plugin, versions up to and including 1.0.4; requires Contact Form 7 to be installed with active RapiSafe upload fields rendered on public-facing pages.

Indicators of Compromise

• RSMFCF7Vars.nonce (exposed client-side JavaScript variable)
• handleAjaxRemoveUpload (vulnerable AJAX action endpoint)
• admin-ajax.php POST requests referencing RapiSafe upload removal action
• Unexpected deletion or truncation of wp-config.php

Remediation Steps

1. 1

   Update the Plugin

   Upgrade RapiSafe – Secure Multi File Upload for Contact Form 7 to a patched version beyond 1.0.4 as soon as it is released; monitor the vendor changelog for the fix.

2. 2

   Temporary Mitigation

   If no patch is available, disable or remove the RapiSafe plugin and any Contact Form 7 forms using its upload field until remediation is confirmed.

3. 3

   Web Application Firewall Rules

   Deploy WAF rules to block or monitor suspicious admin-ajax.php requests targeting the handleAjaxRemoveUpload action, especially those referencing sensitive file paths like wp-config.php.

4. 4

   File Integrity Monitoring

   Implement monitoring/alerting on changes or deletions to critical WordPress core files (wp-config.php, .htaccess) to detect exploitation attempts early.

5. 5

   Backup and Recovery Plan

   Maintain offline, versioned backups of wp-config.php and the full site to enable rapid recovery if the file is deleted or the site is compromised.

6. 6

   Credential Rotation

   If exploitation is suspected, rotate all database credentials, API keys, and secrets stored in wp-config.php or accessible to WordPress, including any keys used by connected agent or automation systems.