CVE-2026-3141 in FormGent Plugin
Summary
by MITRE • 08/01/2026
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in the FormGent WordPress plugin represents a critical security flaw that undermines the integrity and confidentiality of affected websites. This issue stems from a fundamental design oversight in the plugin's REST API implementation where the /wp-json/formgent/responses/attachments endpoint lacks proper authentication mechanisms. The absence of capability checks creates an exploitable vector that allows any remote attacker to perform unauthorized file deletion operations within the plugin's upload directory structure, effectively bypassing the standard WordPress permission model that typically restricts such actions to authenticated administrators.
The technical implementation flaw resides in the routes/rest/api.php file where the REST API route is registered without appropriate authentication middleware. This architectural weakness enables unauthenticated access to sensitive file operations through the WordPress REST API framework, which is designed to provide standardized interfaces for plugin functionality. The vulnerability operates at the application layer and specifically targets the plugin's attachment handling capabilities, exploiting the lack of input validation and access control measures that should normally be enforced before executing destructive file operations.
The operational impact of this vulnerability extends beyond simple data loss scenarios to encompass complete system compromise potential. Attackers can leverage this flaw to delete critical files within the formgent uploads directory, with particularly severe consequences on Linux servers where the upload directory structure may not exist by default post-installation. When the wp-content/uploads/formgent directory is absent, the path traversal protections become ineffective, allowing attackers to navigate beyond the intended plugin boundaries and target system-critical files such as wp-config.php. This escalation capability transforms what might initially appear as a limited file deletion vulnerability into a full site takeover vulnerability that could enable attackers to install malicious software or completely compromise the WordPress installation.
The security implications align with common weakness patterns identified in the CWE repository, specifically mapping to CWE-284 which addresses improper access control and CWE-22 which covers path traversal vulnerabilities. From an attack framework perspective, this vulnerability would be categorized under the ATT&CK technique T1059.001 for command and script interpreter usage and potentially T1486 for data encryption for ransomware operations if attackers choose to leverage the deleted files for further exploitation. The risk assessment indicates a high severity classification due to the combination of unauthenticated access and the potential for complete system compromise.
Mitigation strategies should prioritize immediate plugin updates to versions that implement proper authentication checks and capability validation for REST API endpoints. Administrators must ensure that all WordPress installations maintain current security patches and that plugins undergo regular security audits before deployment. Additionally, implementing network-level restrictions such as firewall rules that limit access to REST API endpoints and monitoring for unusual file deletion patterns can provide additional defense-in-depth measures. The recommended approach includes verifying plugin permissions, establishing proper directory structure validation, and ensuring that authentication middleware is consistently applied across all REST API routes to prevent similar vulnerabilities from emerging in other plugins or custom implementations.