Executive brief
The RapiSafe – Secure Multi File Upload plugin for WordPress allows unauthenticated attackers to delete arbitrary files from the server, including critical configuration files like wp-config.php. An attacker can obtain the security nonce needed for the attack by viewing the HTML source of any Contact Form 7 page using the plugin, then exploit a path traversal vulnerability in the file removal function to delete any file. This can lead to complete server compromise through remote code execution or total site unavailability.
Technical details
The vulnerability is an arbitrary file deletion flaw in the handleAjaxRemoveUpload function caused by insufficient path validation in file removal logic. The attack is unauthenticated and network-accessible: the nonce (CSRF token) required to invoke the removal handler is publicly exposed in JavaScript variables on every page rendering a Contact Form 7 upload field, and the path validation does not prevent directory traversal sequences. An attacker can craft a request to delete arbitrary files on the system by manipulating the file path parameter. Successful exploitation can lead to deletion of critical files such as wp-config.php, resulting in remote code execution or denial of service. All versions up to and including 1.0.4 are affected; patch status should be verified with the plugin vendor.
Affected products
- RapiSafe Secure Multi File Upload for Contact Form 7 up to and including 1.0.4
Timeline
- 2026-08-15: disclosed