CVE-2026-14487
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The Simple Coherent Form plugin for WordPress up to version 2.4.13 is vulnerable to arbitrary file deletion due to insufficient path validation in the removeUploadDir function. The scf_get_id_upload endpoint provides a valid nonce to unauthenticated users, and the secondary hash check relies on a hardcoded salt, making both controls ineffective.
Risk Assessment
An unauthenticated attacker can delete critical files like wp-config.php, potentially leading to remote code execution and full server compromise.
Recommendation
Update the Simple Coherent Form plugin to the latest available version immediately. If no update is available, temporarily disable the plugin.
Original NVD description (English source)
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.