Description

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-11T20:17:27.133Z",
  "pubdate": "2026-08-11T20:17:27.133Z",
  "executiveSummary": "The Formidable Digital Signatures plugin for WordPress is susceptible to an arbitrary file deletion vulnerability resulting from a lack of sufficient file path validation within the delete_file function. This security defect impacts all plugin versions up to, and including, 3.0.6. The flaw exposes the affected server to destructive unauthorized actions, allowing unauthenticated remote threat actors to delete arbitrary files on the underlying filesystem. Exploitation of this vulnerability requires an attacker to interact with any form configured to accept anonymous submissions. By leveraging the standard entry-creation POST flow, an adversary can manipulate input parameters to target and delete critical system or application files, potentially leading to denial of service conditions, data corruption, or complete application compromise. The risk implication is critical due to the unauthenticated nature of the attack vector, requiring minimal attacker capabilities combined with default plugin functionality exposure on public-facing web servers.",
  "technicalDetails": "The vulnerability resides in the delete_file function implemented within the Formidable Digital Signatures plugin for WordPress, affecting all versions up to, and including, 3.0.6. The fundamental root cause is insufficient file path validation and sanitization of user-supplied input prior to performing file system operations. Specifically, the application fails to properly restrict or validate the file paths derived from input parameters processed during the entry-creation lifecycle.\nExploitation of this vulnerability occurs during the standard entry-creation POST flow on any form that permits anonymous submissions. An unauthenticated attacker interacts with the vulnerable endpoint by supplying a malicious, attacker-controlled filename injected into the item_meta[field_id][content] parameter. Concurrently, the attacker supplies the delete_saved_image flag within the same HTTP request.\nUpon receiving the crafted payload, the vulnerable component passes the unvalidated filename directly into the delete_file function. Because the function lacks adequate path traversal checks or strict base directory enforcement, it processes the supplied path and initiates a deletion routine against the targeted file on the server. Depending on the permissions of the web server process, this allows the deletion of arbitrary files accessible to the application user.\nThe attack flow requires no prior authentication or specific privileges, operating entirely over standard network exposure via HTTP POST requests submitted to anonymous-accessible forms. The payload behavior dictates the targeted file location, which can potentially span outside intended media directories if path traversal sequences are supported or if absolute paths are processed. The post-exploitation impact includes application disruption, removal of essential configuration or core files, and localized denial of service."
}