EUVD-2026-42164
GHSA-4x73-r52r-6j65
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network path with both controls bypassable gives AV:N/AC:L/PR:N/UI:N; arbitrary deletion corrupts and destroys files for I:H/A:H, with no data disclosure so C:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Articles & Coverage 2
AnalysisAI
Arbitrary file deletion in the Simple Coherent Form WordPress plugin (all versions up to and including 2.4.13) allows unauthenticated attackers to delete any file the web server can reach, and deleting wp-config.php can cascade into full remote code execution. The plugin's two intended access controls are illusory: the scf_get_id_upload endpoint hands a valid scf_upload_file_removal nonce to any anonymous visitor, and the secondary hash check can be reproduced offline because it derives from a salt hardcoded in the plugin source. There is no public exploit identified at time of analysis, but the flaw carries a high 9.1 CVSS and reflects a genuine unauthenticated-network attack path.
Technical ContextAI
The vulnerability lives in the removeUploadDir function within includes/fields/file.php of Simple Coherent Form, a PHP form-builder plugin for WordPress that accepts and manages user file uploads. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): removeUploadDir fails to canonicalize or constrain the supplied path to the plugin's upload directory, so traversal sequences let the deletion target escape into arbitrary locations on the filesystem. Compounding this, the plugin's authorization layer is defeated by design - WordPress nonces are meant to bind an action to a session, but scf_get_id_upload issues the removal nonce to unauthenticated callers, and the secondary integrity hash relies on a static salt shipped in the plugin code rather than a server-side secret, so it can be forged without any server interaction. The affected CPE is cpe:2.3:a:tombgtn:simple_coherent_form (vendor 'tombgtn').
RemediationAI
No fixed version is identified in the provided data - the references point only to the vulnerable 2.4.13 source and the Wordfence advisory, so this is 'No vendor-released patch identified at time of analysis'; monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/f4831e75-dc0e-4d6f-b2cb-8498d8629319 and the plugin's WordPress.org page for a release above 2.4.13 and upgrade immediately once available. Because the flaw is unauthenticated and network-reachable, the strongest interim control is to deactivate and remove the Simple Coherent Form plugin until a patched version ships, accepting the loss of any forms it powers. If deactivation is not acceptable, use a WAF or web-server rules to block or restrict access to the plugin's AJAX actions scf_get_id_upload and the file-removal endpoint (the scf_upload_file_removal action) - noting this will break legitimate file-removal functionality - and enforce filesystem permissions so the web server user cannot delete wp-config.php or files outside the intended upload directory as a last-resort blast-radius limiter.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today