A missing capability check on a FormGent REST API endpoint lets unauthenticated attackers delete files on affected WordPress sites, and, under a specific server condition described below, potentially arbitrary files including wp-config.php, scoring CVSS 9.1 Critical.
What Is It
CVE-2026-3141 is a missing authorization flaw (CWE-862) in the FormGent plugin for WordPress. The /wp-json/formgent/responses/attachments REST API endpoint is registered in routes/rest/api.php without any authentication middleware, and the handler performs no capability check. Any unauthenticated request can therefore trigger file deletion within the FormGent uploads directory.
The issue escalates beyond that directory on Linux servers where wp-content/uploads/formgent does not yet exist; the default state immediately after plugin installation. In that condition the path traversal protection can be bypassed, allowing deletion of arbitrary files on the host. Where the uploads directory has already been created, the reported impact is confined to files within it.
Why It Matters
The CVE record carries a CVSS 3.1 base score of 9.1 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. That score comes from Wordfence as the assigning CNA, NIST has not yet completed its own analysis, so the NVD entry reflects the CNA-supplied metrics rather than an independent NVD assessment. Network attack vector, low complexity, no privileges, no user interaction, the exploitability sub-score is a maximum 3.9.
Where the traversal bypass condition holds, the practical impact is site takeover, not just data loss. Deleting wp-config.php would put a WordPress instance back into its setup state, letting an attacker walk through a fresh installation and point the site at infrastructure they control. Integrity and availability impact are both rated High.
What's Vulnerable
- Vendor: wpwax
- Product: FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
- Affected versions: all versions up to and including 1.9.2
- Highest risk configuration: Linux hosts where
wp-content/uploads/formgenthas not been created
Patch Status
The referenced changeset diff compares tag 1.9.2 against 1.10.0, and changeset 3604540 modifies AttachmentController.php, indicating the fix landed in 1.10.0. Operators running 1.9.2 or earlier should update to 1.10.0.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or federal remediation deadline associated with it at this time. NVD status is "Received," meaning the record is still awaiting full analysis.
Sources
- NVD, CVE-2026-3141
- Wordfence Threat Intelligence; FormGent vulnerability record
- WordPress Plugin Trac; vulnerable route registration (
routes/rest/api.php#L27) - WordPress Plugin Trac,
AttachmentController.php#L59 - WordPress Plugin Trac; changeset 3604540 (fix)
- WordPress Plugin Trac, 1.9.2 → 1.10.0 diff