Summary
CVE-2026-16230 is a critical unauthenticated arbitrary file deletion vulnerability in the Formidable Digital Signatures plugin for WordPress, developed by Strategy11. The flaw stems from insufficient file path validation in the plugin’s delete_file function, allowing unauthenticated attackers to delete arbitrary files on the web server. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and affects all plugin versions up to and including 3.0.6.
Technical details
- Root cause: The plugin’s
delete_filefunction fails to properly validate or sanitize a user-supplied filename before using it in a file deletion operation, resulting in a relative path traversal weakness (CWE-23). - Trigger conditions: During form submission on a publicly accessible form that uses the Digital Signatures feature, an attacker can supply a crafted filename via the
item_meta[field_id][content]parameter together with adelete_saved_imageflag, causing the plugin to delete a file at an attacker-controlled path. - Attack vector: Network-based (AV:N); the attack requires no authentication (PR:N) and no user interaction (UI:N), and can be carried out against any publicly reachable WordPress site running the vulnerable plugin.
- Impact: Successful exploitation lets an unauthenticated attacker delete arbitrary files on the server, which can lead to denial of service, corruption of site data, and — depending on which files are deleted (e.g.,
wp-config.php) — can potentially be leveraged to fully compromise the site, aligning with the High confidentiality, integrity, and availability impact reflected in the CVSS vector.
Affected software
- Formidable Digital Signatures (WordPress plugin) by Strategy11 — versions up to and including 3.0.6
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-23 (Relative Path Traversal)
Mitigation and recommended actions
- Immediate: Update the Formidable Digital Signatures plugin to version 3.1 or later, which contains a fix for the file path validation flaw.
- If immediate patching is not possible:
- Temporarily deactivate the Formidable Digital Signatures plugin/feature on public-facing forms until the update can be applied.
- Restrict or monitor access to form submission endpoints that process
item_metaparameters, and review web server/application logs for unexpected file deletion activity or anomalousdelete_saved_imagerequests. - Ensure regular, isolated backups of WordPress files and the
wp-config.phpfile are maintained so critical files can be quickly restored if deleted. - Deploy a web application firewall (WAF) rule to block suspicious path traversal patterns (e.g.,
../) in form submission parameters as a temporary compensating control.

