External risk intelligence

Formidable Digital Signatures File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16230

The vulnerability affects a WordPress plugin in a function reachable via anonymous submissions on public-facing forms. Because these forms are designed for public interaction and the vulnerability is triggerable without authentication during standard entry creation, the attack surface is exposed to the public internet by design in normal deployment.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Formidable Digital Signatures WordPress plugin, allowing unauthenticated attackers to delete files on the server. This could potentially impact the integrity and availability of your WordPress site. The main concern is confirming relevance and exposure.

Attackers can delete files from the server.
Plugin allows unauthenticated file deletion.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by submitting a specially crafted request to a public-facing WordPress form handled by the Formidable Digital Signatures plugin. This request, containing an attacker-controlled filename, can trick the plugin into deleting arbitrary files on the server.

No authentication required to attack.
Malicious file deletion via form submission.
Unauthenticated remote file deletion.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could delete arbitrary files from the server. This is possible when the Formidable Digital Signatures plugin is used on a WordPress site with any form that permits anonymous submissions.

Arbitrary file deletion from server.
Via form submission with crafted parameter.
System instability or data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform teams and application owners are likely responsible for addressing this vulnerability. The first practical move is to identify all WordPress instances using the Formidable Digital Signatures plugin, determine if they are publicly accessible or handle sensitive data, and confirm the accountable owner for each. A risk-based remediation plan should then be developed, coordinating with vendor management if necessary.

Platform and application owners must address.
Verify plugin usage and public exposure first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Formidable Digital Signatures plugin?

It is an add-on for WordPress used to capture signatures on digital forms. By integrating with the broader Formidable Forms ecosystem, it allows site administrators to collect verified agreements or approvals directly through standard web forms.

What does CWE-23 mean for CVE-2026-16230?

This vulnerability is classified as Improper Limitation of a Pathname, or CWE-23. In plain English, the plugin fails to properly check the file paths provided by users. Because the code does not verify the input, it allows someone to target and delete files located elsewhere on the server rather than just removing intended temporary images.

How is this file deletion vulnerability triggered?

An attacker triggers this by sending a specific POST request to a public form that uses this plugin. They must include a crafted filename in the item_meta parameter along with a specific delete flag. It does not trigger if the form requires user login, as the exploit relies on the standard entry-creation flow accessible to anonymous visitors.

Is my site relevant to CVE-2026-16230?

According to Halo Surface Signal, this is highly relevant if you use this plugin on forms that accept anonymous, public submissions. Since these forms are intentionally internet-facing, they provide a direct path for an attacker to reach the vulnerable function without needing to bypass any login requirements.

Do I need to take immediate action?

You should start by identifying every WordPress instance where this plugin is installed. Once you have a list of sites, prioritize those with forms that allow public submissions, as these are the most accessible to attackers. Coordinate with your team to review the plugin status and prepare for updates or configuration changes to secure your file system.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.