A critical unauthenticated file deletion vulnerability in the Formidable Digital Signatures plugin allows remote attackers to remove essential server files.

This is a relative path traversal vulnerability (CWE-23) in the delete_file function. By supplying a manipulated filename parameter during an anonymous entry-creation flow, an unauthenticated attacker can delete files outside of the intended directory.

An attacker can delete sensitive configuration files, database files, or core application files, leading to permanent denial of service or potential system instability. The CVSS score of 9.8 reflects the high impact of allowing unauthenticated users to destroy arbitrary data on the host system.

Immediate Action: Update the Formidable Digital Signatures plugin to version 3.1 or later.

Proactive Monitoring: Monitor file system integrity and check access logs for unusual POST requests targeting entry-creation endpoints with unauthorized file paths.

Compensating Controls: If immediate updates are not possible, disable the plugin or restrict access to forms that accept anonymous submissions to prevent exploitation.

Public Exploit Available: Unknown

This vulnerability is highly severe because it allows unauthenticated attackers to perform destructive actions on the server. Administrators must update the plugin to version 3.1 immediately. If an update cannot be performed, the affected functionality should be disabled to prevent potential system disruption.