The vulnerability arises from inadequate file path validation in RapiSafe’s handleAjaxRemoveUpload function, allowing an attacker to delete any file on the server. By removing essential system files such as wp-config.php, an unauthenticated attacker can pivot to remote code execution. This flaw is categorized as a path traversal (CWE‑22) and compromises the integrity and availability of the site while also exposing sensitive data if configuration files are deleted.

The issue affects the RapiSafe – Secure Multi File Upload for Contact Form 7 WordPress plugin, specifically all releases up to and including version 1.0.4. The plugin is typically deployed on WordPress installations to enable file uploads via Contact Form 7.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score is not available, and the weakness is not listed in CISA’s KEV catalog at this time. The attack vector is likely through any public‑facing page that includes a RapiSafe upload field, because the required nonce (RSMFCF7Vars.nonce) is embedded in JavaScript and can be retrieved by an unauthenticated user, making the deletion endpoint easily reachable.