WordPress security changelog
CRITICAL CVE-2026-3141 Received

FormGent lets visitors delete server files through its attachment endpoint

FormGent through 1.9.2 registers /wp-json/formgent/responses/attachments without authentication middleware or a capability check. An unauthenticated visitor can submit a file path to the attachment-deletion handler and delete files inside the FormGent uploads directory. On Linux when wp-content/uploads/formgent does not yet exist, which is the default immediately after installation, the path-containment check can be bypassed with traversal input; this expands the deletion primitive to arbitrary server files such as wp-config.php. Deleting that configuration file can expose the site to takeover through a fresh WordPress installation.

CVE / CNA score 9.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
Plugin slug
formgent
Affected
<= 1.9.2
Safe version
1.10.0
Published
Aug 01, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Aug 01, 2026 and is one of 3 known issues for this plugin.

What to do

Update, patch or deactivate.

Update FormGent to 1.10.0 or later. If a vulnerable release was exposed, inspect REST and server logs for requests to /wp-json/formgent/responses/attachments, verify wp-config.php and other application files against trusted copies, restore deleted files, and investigate the site if configuration loss or an unexpected WordPress installation occurred.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Primary and upstream sources