A security flaw has been found in the RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress, affecting all versions up to and including 1.0.4. The plugin does not properly check file paths when handling requests to delete uploaded files, which means anyone (even visitors who are not logged into your WordPress admin area) can delete any files stored on your web server.
This is a high-severity issue because deleting certain critical WordPress files, such as the wp-config.php file that controls your site's core settings and database connection, can let attackers take full control of your site. Once they have that access, they can run malicious code, steal customer or site data, alter your site's content, or use your site to harm your visitors. The security token required to trigger this file deletion is also publicly visible in the page code for any visitor to a page that has a Contact Form 7 form with a RapiSafe upload field, so attackers can easily grab it without needing any special permissions.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-14484
