CVE-2026-3141: WordPress FormGent Plugin Unauthorized File Deletion (CVSS 9.1)

Overview

A critical security vulnerability has been identified in the FormGent plugin for WordPress, tracked as CVE-2026-3141 with a CVSS score of 9.1 (Critical). The flaw allows unauthenticated attackers to delete arbitrary files on the server, which can have devastating consequences including complete site takeover.

Vulnerability Details

Technical Description

The vulnerability exists in the /wp-json/formgent/responses/attachments REST API endpoint. The endpoint is registered without any authentication checks, and the handler function lacks a capability check before processing file deletion requests.

An unauthenticated attacker can send crafted requests to this endpoint to delete arbitrary files accessible to the web server process. This is particularly dangerous because:

• No authentication is required — any remote attacker can exploit this
• Arbitrary file deletion — attackers can target any file accessible by the PHP process
• Potential for full compromise — deleting critical WordPress files (e.g., wp-config.php) can force a WordPress reinstallation, allowing attackers to reconfigure the site with their own credentials

Attack Scenario

1. Attacker sends a crafted DELETE or POST request to /wp-json/formgent/responses/attachments
2. The endpoint processes the request without verifying the requester's identity or permissions
3. The target file is deleted from the server filesystem
4. Attacker can delete wp-config.php, triggering WordPress setup mode
5. Attacker completes WordPress installation with administrative credentials

Affected Versions

All versions of the FormGent plugin up to and including 1.9.2 are vulnerable.

Mitigation

Update immediately. Plugin users should:

1. Update the FormGent plugin to the latest version (1.9.3 or later) which includes the patch
2. Review server logs for suspicious REST API requests targeting the /wp-json/formgent/ namespace
3. Verify file integrity on affected WordPress installations
4. Consider temporarily disabling the plugin until the update can be applied

Detection

Look for unauthorized REST API requests in your web server logs:

POST /wp-json/formgent/responses/attachments
DELETE /wp-json/formgent/responses/attachments

Requests from unexpected IP addresses or at unusual times targeting this endpoint should be treated as suspicious and investigated immediately.

References

• NVD: CVE-2026-3141
• WordPress Plugin Repository: FormGent