High · 8.6 CVE-2025-68912 EUVD-2026-3965GHSA-q65c-hvrq-4vmv

WordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability

Published Jan 22, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: harmonic_design Product: HDForms

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1.

Affected products

Vendor	Product	Affected	Fixed
Harmonic Design	HDForms	≤ 1.6.1	—

References

https://patchstack.com/database/Wordpress/Plugin/hdforms/vulnerability/wordpress-hdforms-plugin-1-6-1-arbitrary-file-deletion-vulnerability?_s_id=cve vdb-entry