RapiSafe CF7 CVE-2026-14484

Exploitation requires that the target site (a) runs the RapiSafe plugin at version 1.0.4 or earlier alongside Contact Form 7, and (b) has at least one public CF7 form that renders a RapiSafe upload field - that rendering is what emits the RSMFCF7Vars.nonce value and exposes the handleAjaxRemoveUpload handler to anonymous users. Given those conditions, no authentication, privileges, or user interaction are needed: any unauthenticated visitor can read the nonce and invoke the deletion. The practical limiting factors are therefore the presence of the plugin and an exposed upload field on a reachable page, plus web-server write permissions on the target file (the RCE pivot specifically depends on the PHP process being able to delete wp-config.php); sites that have the plugin installed but not surfaced on any public form are not directly exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, with high integrity and availability impact and no confidentiality impact - consistent with unauthenticated arbitrary file deletion rather than data theft, and the description's nonce-exposure detail credibly supports the PR:N (unauthenticated) rating rather than contradicting it. Real-world priority is elevated because deletion of wp-config.php is a well-understood path to takeover: an emptied config sends WordPress into its setup wizard, letting an attacker point the site at an attacker-controlled database and achieve code execution, so the I:H/A:H impact understates the practical worst case. No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation yet - but the low attack complexity, lack of authentication, and clear RCE pivot mean any operator running this plugin should treat it as urgent and patch/remove it immediately rather than waiting for EPSS or KEV signals to catch up. The main uncertainty is the size of the installed base, not the severity of the flaw.

An anonymous attacker loads a public contact page that renders a RapiSafe upload field, reads the CSRF nonce directly from the RSMFCF7Vars.nonce JavaScript variable, and sends a single crafted admin-ajax request to the removal handler with a traversal path like ../../../wp-config.php. The server deletes the file, and the attacker then reloads the site to trigger the WordPress setup wizard and reconfigure it against a database they control, achieving remote code execution. No exploit code is publicly identified at time of analysis, but the low complexity makes weaponization straightforward.