An improper limitation on pathname handling in the HDForms plugin allows a path traversal attack that can delete arbitrary files from the server. The flaw is present in all releases up to and including version 1.6.1, giving an attacker the ability to specify a file path that bypasses the intended directory restrictions. If successful, the attacker can remove critical configuration files, scripts, or any file accessible to the web‑server process, compromising integrity and availability.

The vulnerability affects Harmonic Design’s HDForms WordPress plugin for all versions from the first release through 1.6.1, including the 1.6.1 build used in many WordPress sites. The plugin is installed in the WordPress plugin directory and processes file‑path inputs from form submissions or administration actions.

With a CVSS score of 8.6 the flaw is considered high‑severity. The EPSS score of less than 1 % indicates a low likelihood of active exploitation at this time, and CISA does not list it in the KEV catalog. The attack appears to be remote, relying on an attacker being able to supply a crafted form or request to the plugin, and requires the plugin to run with file‑write permissions on the website’s file system.