Rapisafe Secure Multi File Upload For Contact Form 7
Monthly
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).