CVE-2026-3141 Details
Description
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
A vulnerability in the FormGent WordPress plugin, in versions through 1.9.2, allows for unauthorized deletion of arbitrary files. This issue arises from a missing capability check on the '/wp-json/formgent/responses/attachments' REST API endpoint, which was registered without authentication middleware. As a result, unauthenticated attackers can delete any file within the FormGent uploads directory. Furthermore, on Linux servers where the 'wp-content/uploads/formgent' directory has not yet been created (the default state after installation), the vulnerability can be exploited to bypass path traversal protections, potentially allowing the deletion of critical files like 'wp-config.php'. Such an action could lead to a complete takeover of a fresh WordPress installation.
Users are advised to update the FormGent WordPress plugin to version 1.10.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 1, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FormGent | <= 1.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |