A security vulnerability has been found in the RapiSafe – Secure Multi File Upload for Contact Form 7 plugin, a tool used to add file upload features to WordPress contact forms built with Contact Form 7. All versions of the plugin up to and including 1.0.4 are affected, due to insufficient validation of file paths when the plugin processes file deletion requests.
This flaw allows unauthenticated attackers (any visitor to your site, even if they are not logged into your WordPress dashboard) to delete arbitrary files stored on your web server. If an attacker deletes the critical core site file wp-config.php, which stores your site's configuration and database credentials, they can gain full control of your website. This would let them modify your site content, steal sensitive data, or take over the site entirely.
The security check designed to block unauthorized access to the file deletion feature is accidentally exposed in public page code on any page that has a Contact Form 7 form with a RapiSafe upload field. Any visitor to these pages can grab this security check and use it to exploit the vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-14484
