Description

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-15T03:16:47.263Z",
  "pubdate": "2026-08-15T03:16:47.263Z",
  "executiveSummary": "The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to an arbitrary file deletion security flaw impacting all versions up to, and including, 1.0.4. This vulnerability stems from insufficient file path validation implemented within the plugin's AJAX request handling mechanism. Consequently, unauthenticated remote attackers can leverage this flaw to delete arbitrary files residing on the underlying server. Successful exploitation of this vulnerability presents severe risk implications, as the deletion of critical application files—such as wp-config.php—can easily precipitate complete application compromise, leading to remote code execution or installation reset routines. The attack vector requires no prior authentication or administrative privileges, relying solely on the ability to interact with publicly exposed JavaScript variables to retrieve the necessary cryptographic nonce required to invoke the vulnerable AJAX handler. Mitigation requires patching the input validation logic and safeguarding sensitive AJAX action endpoints against unauthorized invocations.",
  "technicalDetails": "The vulnerability resides in the handleAjaxRemoveUpload function within the RapiSafe – Secure Multi File Upload for Contact Form 7 plugin, affecting all versions up to, and including, 1.0.4. The root cause of the security defect is insufficient file path validation, which allows user-supplied input targeting file locations to be processed without rigorous sanitization or boundary checks. During the execution of the handleAjaxRemoveUpload function, the application fails to adequately verify whether the target file path resides strictly within the designated upload directory.\nAlthough an AJAX action handler typically requires a security nonce to validate the request origin, the nonce required to invoke this specific removal handler is inadvertently exposed in public-facing JavaScript. Specifically, the required nonce is rendered globally accessible via RSMFCF7Vars.nonce on every Contact Form 7 page containing a RapiSafe upload field. Because this script context is publicly accessible, any unauthenticated visitor can harvest the nonce directly from the page source.\nThe attack flow proceeds as follows: First, an unauthenticated attacker visits a publicly accessible page containing the Contact Form 7 form with the RapiSafe upload field. Second, the attacker inspects the page source or DOM to extract the RSMFCF7Vars.nonce value. Third, the attacker crafts a malicious AJAX request directed at the WordPress environment, supplying the harvested nonce alongside a manipulated parameter specifying the target file path. Because the vulnerable handleAjaxRemoveUpload function lacks adequate file path validation, it processes the request and deletes the specified file from the server file system.\nThe post-exploitation impact is critical. By systematically targeting core configuration or system files, such as wp-config.php, attackers can disrupt service availability or trigger application installation routines that allow the creation of administrative accounts. Furthermore, file deletion primitives in environments with specific misconfigurations can facilitate further exploitation chains, ultimately leading to remote code execution."
}