CVE-2026-3141
Received Received - Intake

Arbitrary File Deletion in FormGent WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-3141
EUVD
EUVD-2026-51725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
formgent formgent to 1.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FormGent WordPress plugin has a vulnerability allowing unauthenticated attackers to delete arbitrary files via a REST API endpoint. The plugin fails to check user permissions before processing file deletion requests, enabling complete site compromise in certain server configurations.

Detection Guidance

Check for unauthorized file deletions in the WordPress uploads directory, particularly in the formgent folder. Review server logs for suspicious REST API requests to /wp-json/formgent/responses/attachments. Look for missing files or unexpected changes in wp-config.php or other critical files.

Impact Analysis

Attackers could delete critical WordPress files including wp-config.php, leading to complete site takeover. On fresh installations, path traversal protections are bypassed, allowing deletion of any file within the server's filesystem.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or site compromise, violating data integrity requirements in GDPR and HIPAA. Unauthorized file deletion may constitute a breach of security controls mandated by these regulations.

Mitigation Strategies

Update the FormGent plugin to the latest version if available. If not, disable the plugin immediately. Restrict file permissions in the WordPress uploads directory to prevent unauthorized access. Monitor for any signs of file deletion or site compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart