FormGent (<= 1.9.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/formgent--1.9.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 01 Aug 2026 07:49:18 +0000Unauthenticated Arbitrary File Deletion in FormGent WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-formgent-vulnerability/Sat, 01 Aug 2026 07:49:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-formgent-vulnerability/The FormGent WordPress plugin is vulnerable to unauthorized arbitrary file deletion via an unauthenticated REST API endpoint, potentially allowing attackers to delete critical files like wp-config.php and achieve site takeover.The FormGent WordPress plugin (versions 1.9.2 and earlier) contains a critical security vulnerability (CVE-2026-3141) stemming from a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint. The registration of this endpoint in routes/rest/api.php lacks necessary authentication middleware, allowing unauthenticated remote attackers to trigger file deletion processes. The vulnerability is compounded by insufficient path traversal validation, particularly in default installations where the expected target directory does not yet exist. Attackers can exploit this to delete sensitive files, including the WordPress configuration file wp-config.php. Once wp-config.php is removed, the target site effectively reverts to an uninitialized state, permitting an attacker to perform a fresh WordPress installation and gain complete administrative control over the application and underlying data.

Impact

Successful exploitation allows for the permanent deletion of arbitrary files on the web server, leading to potential denial of service or full site takeover. Organizations running vulnerable versions of FormGent are at risk of data loss and administrative compromise. While the specific number of affected installations is not provided, the plugin's presence across the WordPress ecosystem presents a significant risk to affected web servers.

Recommendation

  • Immediately update the FormGent plugin to the latest patched version to remediate CVE-2026-3141.
  • Review web server access logs for anomalous POST requests targeting the /wp-json/formgent/responses/attachments endpoint.
  • Audit file system integrity for the presence of the wp-config.php file in the WordPress root directory to ensure it has not been removed.
  • Implement strict file system permissions for the web server user, preventing the deletion of critical WordPress configuration files.
]]>criticaladvisory