CVE-2026-16230: Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the itemmeta[fieldid][content] parameter alongside the deletesavedimage flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Formidable Digital Signaturesto a version that resolves this vulnerability.Fixed in 3.0.6 - Compensating control
Restrict access to the WordPress form endpoints that accept anonymous submissions (the standard entry-creation POST flow) so unauthenticated attackers cannot supply item_meta[field_id][content] alongside delete_saved_image.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16230?
CVE-2026-16230 has a critical severity rating of 9.8.
How do I fix CVE-2026-16230?
To fix CVE-2026-16230, update the Formidable Digital Signatures plugin to version 3.0.7 or later.
What is CVE-2026-16230?
CVE-2026-16230 is a vulnerability in the Formidable Digital Signatures plugin that allows unauthenticated file deletion due to insufficient validation.
Who is affected by CVE-2026-16230?
All users of the Formidable Digital Signatures plugin versions up to 3.0.6 are affected by CVE-2026-16230.
Can CVE-2026-16230 be exploited remotely?
Yes, CVE-2026-16230 can be exploited remotely by unauthenticated attackers to delete files on the server.