Description
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Published: 2026-07-08
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion because its removeUploadDir function does not validate file paths, allowing any unauthenticated user to direct the server to delete any file that the web server can write to. The scf_get_id_upload endpoint issues a usable nonce and a forgeable hash check, eliminating any real authorization boundary. Deleting core files such as wp-config.php can lead to remote code execution or site compromise.

Affected Systems

All WordPress installations running Simple Coherent Form 2.4.13 or earlier are affected. The plugin is distributed by tombgtn under the name Simple Coherent Form. The vulnerability exists in all revisions up to and including 2.4.13.

Risk and Exploitability

The vulnerability is rated CVSS 9.1, classifying it as a critical flaw. The EPSS score is below 1%, yet the complete lack of authentication means an attacker can trigger the deletion from any IP address that can reach the site. This straightforward attack surface can result in file loss, database corruption, or complete site takeover. The flaw is not yet listed in the CISA KEV catalog, but the potential impact is high.

Generated by OpenCVE AI on July 29, 2026 at 14:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Simple Coherent Form plugin to a version newer than 2.4.13 that removes the vulnerable removeUploadDir function
  • If an upgrade cannot be performed immediately, block unauthenticated access to the scf_get_id_upload and scf_upload_file_removal endpoints using a web‑application firewall or by adding nginx configuration
  • Restrict file permissions on the WordPress filesystem so that the web server cannot delete critical files, for example by setting ownership to the WordPress user and limiting write permissions
  • Disable or uninstall the Simple Coherent Form plugin if it is not required

Generated by OpenCVE AI on July 29, 2026 at 14:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Tombgtn
Tombgtn simple Coherent Form
Wordpress
Wordpress wordpress
Vendors & Products Tombgtn
Tombgtn simple Coherent Form
Wordpress
Wordpress wordpress

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Description The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Title Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Tombgtn Simple Coherent Form
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-08T13:12:21.710Z

Reserved: 2026-07-02T17:04:50.309Z

Link: CVE-2026-14487

cve-icon Vulnrichment

Updated: 2026-07-08T13:12:18.626Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T15:00:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')