File Deletion Vulnerability in Formidable Digital Signatures Plugin for WordPress

CVE-2026-16230

What is CVE-2026-16230?

The Formidable Digital Signatures plugin for WordPress suffers from a file deletion vulnerability due to inadequate file path validation in its delete_file function. This issue exists in all versions up to and including 3.0.6. Malicious actors can exploit this flaw by sending a specially crafted filename through the item_meta[field_id][content] parameter, along with the delete_saved_image flag during the entry-creation process of any form that permits anonymous submissions, potentially resulting in unauthorized file deletion on the server.

References