What the vulnerability does
01Description
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Explanation of Vulnerability in Simple Terms
02Summary
Simple Coherent Form versions 2.4.13 and earlier contain a path traversal vulnerability that allows an attacker to modify or delete files on the server without authentication. The vulnerability exists in how the form processes file paths, enabling an unauthenticated attacker to traverse directories and manipulate arbitrary files. This can lead to site defacement, data loss, or complete system compromise.
What an attacker can do
03Attacker Capabilities
Modify or delete files on the server without logging in.
Potential impact on your site
04Site Impact
An attacker can alter or remove critical site files, causing data loss or taking the site offline.
Conditions required to exploit
05Prerequisites
Network access to the form; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 8, 2026
CVE published
July 8, 2026
Record updated
