A popular WordPress plugin used to add secure multi-file upload features to Contact Form 7 forms has a critical security flaw affecting all versions up to and including 1.0.4. The flaw lets any visitor to your site, even someone who is not logged into your WordPress dashboard, delete arbitrary files stored on your web server. This happens because the plugin does not properly verify file paths when processing requests to remove uploaded files.
If an attacker deletes the right core file, such as WordPress’s main configuration file, they can gain full control of your site and run malicious code on it. This exploit is possible because a security token meant to restrict access to the file deletion feature is accidentally exposed in public-facing website code on every page that has a Contact Form 7 form with a RapiSafe upload field. Any visitor can collect this token and use it to trigger the file deletion flaw.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-14484
