CVE-2026-14487: The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val

The Simple Coherent Form plugin for WordPress (versions up to 2.4.13) has a vulnerability where attackers can delete any file on the server because the plugin doesn't properly check file paths before deletion. Since anyone can access the deletion feature without logging in, attackers could delete critical files like wp-config.php (the main configuration file) to gain control of the website through remote code execution (running malicious commands on the server).