Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
Strategic Overview
- Status
- Patched in 3.1
- Affected Plugin
- Formidable Digital Signatures
- Affected Version
<= 3.0.6- CVSS
- 9.8Critical
- Weakness type
- CWE-23 · Relative Path Traversal
- CVE
CVE-2026-16230
At a glance
CVE-2026-16230 is a critical-severity Relative Path Traversal vulnerability in the Formidable Digital Signatures WordPress plugin, affecting versions <= 3.0.6. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 3.1; sites on affected versions should update now. Disclosed August 2026, reported by Rafie Muhammad.
Vulnerability Overview
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.
Remediation
Update to version 3.1, or a newer patched version
How does WordSec protect against this?
Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Formidable Digital Signatures 3.1 closes this, and updating the plugin is the step that ends it.
- Firewall
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C