Unauthenticated Arbitrary File Deletion in FormGent WordPress Plugin

The FormGent WordPress plugin (versions 1.9.2 and earlier) contains a critical security vulnerability (CVE-2026-3141) stemming from a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint. The registration of this endpoint in routes/rest/api.php lacks necessary authentication middleware, allowing unauthenticated remote attackers to trigger file deletion processes. The vulnerability is compounded by insufficient path traversal validation, particularly in default installations where the expected target directory does not yet exist. Attackers can exploit this to delete sensitive files, including the WordPress configuration file wp-config.php. Once wp-config.php is removed, the target site effectively reverts to an uninitialized state, permitting an attacker to perform a fresh WordPress installation and gain complete administrative control over the application and underlying data.

Impact

Successful exploitation allows for the permanent deletion of arbitrary files on the web server, leading to potential denial of service or full site takeover. Organizations running vulnerable versions of FormGent are at risk of data loss and administrative compromise. While the specific number of affected installations is not provided, the plugin's presence across the WordPress ecosystem presents a significant risk to affected web servers.

Recommendation

• Immediately update the FormGent plugin to the latest patched version to remediate CVE-2026-3141.
• Review web server access logs for anomalous POST requests targeting the /wp-json/formgent/responses/attachments endpoint.
• Audit file system integrity for the presence of the wp-config.php file in the WordPress root directory to ensure it has not been removed.
• Implement strict file system permissions for the web server user, preventing the deletion of critical WordPress configuration files.