RapiSafe CF7: Unauthenticated File Deletion Leading to RCE
RapiSafe CF7 WP plugin (≤1.0.4) allows unauthenticated arbitrary file deletion; removing wp-config.php leads to remote code execution. CVSS 9.1.
- Vendor
- RapiSafe
- Product
- RapiSafe — Secure Multi File Upload for Contact Form 7
- CVSS
- 9.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
RapiSafe — Secure Multi File Upload for Contact Form 7 (all versions through 1.0.4) exposes an upload-removal AJAX handler, handleAjaxRemoveUpload, that requires a nonce for access. However, the nonce is embedded in the page source of any page containing a Contact Form 7 form — making it retrievable by any unauthenticated visitor who can load that page. The path validation applied to the removal target is insufficient to prevent traversal outside the uploads directory, allowing an attacker to specify paths to arbitrary files on the server.
The highest-impact scenario: deleting wp-config.php causes WordPress to enter its setup wizard on the next page load, allowing the attacker to reconfigure the database connection and take full administrative control. Deletion of other critical server files achieves comparable outcomes.
Affected versions: all versions through 1.0.4
Fixed in: 1.0.5
What to do: Update to version 1.0.5 or later immediately. If a patched version is not yet available in your plugin manager, deactivate the plugin — there is no configuration-level workaround for this flaw in affected versions.
See also: full write-up covering this and two related critical WordPress plugin flaws.
