WordPress Simple Coherent Form <=2.4.13 Unauthenticated Arbitrary File Deletion (CVE-2026-14487)

Vulnerability Overview Vulnerability Name: Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter CVE ID: CVE-2026-14487 CVSS Score: 9.1 (Critical) Publication Date: July 7, 2026 Last Update Date: July 8, 2026 Researcher: CHOIGYEONGMIN Affected Scope Software Type: Plugin Software Name: Simple Coherent Form Affected Versions: <= 2.4.13 Remediation Patch Status: No known patch Recommended Measures: Review vulnerability details and implement mitigation measures based on organizational risk tolerance. It may be necessary to uninstall the affected software and seek alternative solutions. Vulnerability Description The Simple Coherent Form plugin for WordPress contains an arbitrary file deletion vulnerability due to insufficient file path validation in the function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (RCE) if the targeted file is . The endpoint freely processes valid files, allowing deletion of files for any unauthenticated user. Additionally, the secondary hash check on the deletion endpoint is bypassed because it relies on a hardcoded salt embedded in the plugin source, meaning it does not enforce a genuine authorization boundary. Reference Links plugins.trac.wordpress.org Additional Information API Documentation: Wordfence Intelligence API Documentation Webhook Documentation: Wordfence Intelligence Webhook Documentation Copyright Information Copyright: 2012-2026 Defiant Inc. MITRE Corporation: 1999-2026 Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Instagram: Wordfence Subscription Subscription Link: Wordfence Intelligence Disclaimer Disclaimer: The content on this page is for reference only and does not constitute any legal or technical advice. Summary This vulnerability allows unauthenticated attackers to delete arbitrary files via the parameter, potentially leading to remote code execution. It is recommended to update or uninstall the affected plugin as soon as possible, and to refer to official documentation for additional mitigation measures.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Simple Coherent Form <=2.4.13 Unauthenticated Arbitrary File Deletion (CVE-2026-14487)

More from this source