CVE-2026-14487
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The Simple Coherent Form plugin for WordPress up to version 2.4.13 is vulnerable to arbitrary file deletion due to insufficient path validation in the removeUploadDir function. The scf_get_id_upload endpoint provides a valid nonce to unauthenticated users, and the secondary hash check relies on a hardcoded salt, making both controls ineffective.
Risk Assessment
An unauthenticated attacker can delete critical files like wp-config.php, potentially leading to remote code execution and full server compromise.
Recommendation
Update the Simple Coherent Form plugin to the latest available version immediately. If no update is available, temporarily disable the plugin.
Related vulnerabilities
- CVE-2026-113744Critical
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the httpd Web Management Service component. Manipulation of the firewallEn argument leads to a stack-based buffer overflow. The attack may be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-114119Critical
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
- CVE-2026-114108Critical
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
- CVE-2026-113736Critical
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the HNAP Login component. Manipulation of the Password argument leads to an empty password in the configuration file. The attack can be initiated remotely and the exploit has been disclosed to the public.
- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-91665Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
- CVE-2026-91663Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91658Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91656Critical
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-91655Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
Original NVD description (English source)
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS