CVE-2026-16230

Deferred Deferred - Pending Action

File Deletion Vulnerability in Formidable Digital Signatures WordPress Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Wordfence

Description

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-16230

EUVD

EUVD-2026-56928

Affected Vendors & Products

Vendor	Product	Version / Range
formidable_forms	digital_signatures	to 3.0.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

The Formidable Digital Signatures plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete files on the server. This happens because the plugin does not properly check file paths before deleting them. Attackers can exploit this by sending a specially crafted request during form submissions, tricking the system into deleting important files.

Detection Guidance

Check for unauthorized file deletions in WordPress upload directories or server logs. Look for POST requests to forms with delete_saved_image flag and item_meta[field_id][content] parameters. Monitor for missing or altered files in signature-related directories.

Impact Analysis

This vulnerability can lead to data loss, website downtime, or unauthorized access to sensitive information. Attackers could delete critical files, disrupt services, or compromise the integrity of your WordPress site. It poses a high risk due to the potential for complete system compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion or exposure. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding health information. A breach could result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the Formidable Digital Signatures plugin to version 3.1 or later immediately. Disable anonymous form submissions if not required. Review server logs for signs of exploitation. Consider temporary removal of the plugin until updated.

Hi! I’m here to help you understand CVE-2026-16230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70