CVE-2026-16230 is a critical CWE-23 Relative Path Traversal vulnerability in the Formidable Digital Signatures plugin for WordPress. The flaw exists in the delete_file function, which does not properly validate file paths. An attacker can supply a malicious filename in the item_meta[field_id][content] parameter along with the delete_saved_image flag during the entry-creation POST flow on any form accepting anonymous submissions. This allows unauthenticated remote attackers to delete arbitrary files on the server, impacting confidentiality, integrity, and availability.

Successful exploitation enables unauthenticated attackers to delete arbitrary files on the server hosting the vulnerable plugin. This can lead to denial of service, loss of data, and potential further compromise depending on which files are deleted. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to forms accepting anonymous submissions or disable the Formidable Digital Signatures plugin if possible. Monitor for vendor updates and apply patches promptly once available.