CVE-2026-3141
CRITICAL · 9.1Published hours ago, high CVSS, no PoC/KEV yet, but exploitation is straightforward and inevitable.
What: FormGent WordPress plugin (≤1.9.2) allows unauthenticated arbitrary file deletion via unauth REST API endpoint; path traversal can delete wp-config.php, enabling site takeover. CVSS 9.1 CRITICAL.
Why it matters: Published today with high CVSS score and clear exploitation path (no auth required, REST endpoint exposed). NVD details confirm complete site takeover risk on default Linux installs. Not yet KEV-listed but imminent risk to thousands of WordPress sites running the plugin.
Where it's seen: Multilingual social chatter (Hebrew, Russian, Japanese) on Bluesky amplifying disclosure same-day; posts describe practical exploitation scenarios. No public PoC or in-the-wild reports visible yet, but vulnerability is trivial to exploit (REST endpoint + file deletion + no checks).
RISK: CRITICAL — Unauthenticated remote file deletion + wp-config.php takeover + trivial exploit path.
Description
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Weaknesses
References
- https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/app/Http/Controllers/AttachmentController.php#L59
- https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/routes/rest/api.php#L27
- https://plugins.trac.wordpress.org/browser/formgent/trunk/app/Http/Controllers/AttachmentController.php#L59
- https://plugins.trac.wordpress.org/browser/formgent/trunk/routes/rest/api.php#L27
- https://plugins.trac.wordpress.org/changeset/3604540/formgent/trunk/app/Http/Controllers/AttachmentController.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fformgent/tags/1.9.2&new_path=%2Fformgent/tags/1.10.0
- https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c?source=cve