CVE-2026-16230 Overview
The Formidable Digital Signatures plugin for WordPress contains an arbitrary file deletion vulnerability affecting all versions up to and including 3.0.6. The flaw resides in the delete_file function, which fails to properly validate file paths before removing files from the server. Unauthenticated attackers can exploit the issue by submitting a crafted item_meta[field_id][content] parameter with the delete_saved_image flag during the standard entry-creation POST flow. Any form that accepts anonymous submissions becomes a viable entry point. Successful exploitation allows deletion of arbitrary files, which can lead to site compromise when critical files such as wp-config.php are targeted.
Critical Impact
Unauthenticated attackers can delete arbitrary files on the WordPress server, enabling site takeover through forced reinstallation flows when wp-config.php is removed.
Affected Products
- Formidable Digital Signatures plugin for WordPress — all versions through 3.0.6
- WordPress sites using Formidable Forms with the Digital Signatures add-on
- Any WordPress form configured to accept anonymous submissions
Discovery Timeline
- 2026-08-11 - CVE-2026-16230 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-16230
Vulnerability Analysis
The vulnerability is classified as a relative path traversal issue [CWE-23] within the plugin's file handling logic. The delete_file function accepts a user-supplied filename without sanitizing directory traversal sequences or restricting deletion to a designated upload directory. When the plugin processes an entry submission with the delete_saved_image flag set, it invokes delete_file against the attacker-controlled value from item_meta[field_id][content].
Because the vulnerable code path runs during standard form submission, no authentication is required on any site that publishes a form accepting anonymous entries. The exploit surface therefore extends to a large portion of public-facing WordPress deployments running the plugin.
Root Cause
The root cause is insufficient file path validation. The plugin trusts the client-supplied content field as a legitimate reference to a previously uploaded signature image. It does not enforce a canonical base directory, reject ../ sequences, or verify that the target file was created by the plugin. Any string interpretable as a file path becomes a deletion target.
Attack Vector
An attacker sends a POST request to a public form endpoint, populating standard entry-creation fields alongside item_meta[field_id][content] with a traversal path such as one resolving to wp-config.php. Setting delete_saved_image=1 triggers the vulnerable branch. The web server user account executes the delete operation, so any file writable by PHP is at risk. Removing wp-config.php forces WordPress into its setup flow, which an attacker can complete to bind the site to a database they control and achieve full takeover.
See the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-16230
Indicators of Compromise
- POST requests to WordPress admin-ajax.php or form submission endpoints containing delete_saved_image parameters
- item_meta[][content] values containing directory traversal sequences such as ../ or absolute paths
- Unexpected disappearance of core WordPress files, including wp-config.php, .htaccess, or plugin files
- WordPress returning to the initial installation screen without administrator action
Detection Strategies
- Inspect web server access logs for POST requests to form endpoints that include the delete_saved_image flag paired with suspicious content field values
- Deploy file integrity monitoring on the WordPress installation directory to alert on deletion of core, plugin, or theme files
- Correlate anonymous form submissions with subsequent file system deletion events observed on the underlying host
Monitoring Recommendations
- Enable verbose logging on the Formidable Forms plugin and forward events to a centralized log platform for retention and analysis
- Alert on any modification or deletion of wp-config.php, .htaccess, and files in wp-includes/ and wp-admin/
- Track anomalous spikes in anonymous form submissions to sites running the affected plugin
How to Mitigate CVE-2026-16230
Immediate Actions Required
- Update the Formidable Digital Signatures plugin to a version later than 3.0.6 as indicated in the Formidable Forms Changelog
- Audit the WordPress installation for missing or modified core files and restore from a known-good backup if tampering is detected
- Temporarily disable forms that accept anonymous submissions if patching cannot be applied immediately
- Rotate database credentials and WordPress secret keys if wp-config.php deletion is confirmed
Patch Information
The vendor addressed the vulnerability in the release documented on the Formidable Forms Changelog. Administrators should upgrade to the patched version immediately. Refer to the Formidable Forms Homepage for the latest distribution.
Workarounds
- Disable the Formidable Digital Signatures plugin until the patch can be applied
- Restrict access to form submission endpoints using a web application firewall rule that blocks requests containing delete_saved_image combined with traversal patterns in item_meta values
- Enforce filesystem permissions that prevent the web server user from deleting core WordPress files where operationally feasible
# Example WAF rule pattern to block exploitation attempts
# Reject POST bodies that combine delete_saved_image with traversal in item_meta content
SecRule REQUEST_METHOD "@streq POST" \
"chain,phase:2,deny,status:403,id:1026162301,\
msg:'CVE-2026-16230 Formidable Digital Signatures file deletion attempt'"
SecRule REQUEST_BODY "@rx delete_saved_image" \
"chain"
SecRule REQUEST_BODY "@rx item_meta\[[^\]]+\]\[content\]=[^&]*(\.\./|/etc/|wp-config)" \
"t:none,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
