Junglewise Threat Intelligence

CVE-2026-3141: wpwax FormGent arbitrary file deletion in REST API

CVE-2026-3141 · Severity: critical · CVSS 9.1 · Published 2026-08-01

Executive brief

FormGent, a WordPress plugin used for creating forms and quizzes, contains a security flaw that allows unauthorized individuals to delete files from the web server. In certain configurations, an attacker could delete critical system files like the site's configuration file. This could allow a malicious actor to reset the website and take full control of the entire WordPress installation, leading to a complete loss of data and site ownership.

Technical details

The FormGent plugin for WordPress (versions up to 1.9.2) is vulnerable to unauthorized arbitrary file deletion due to a missing capability check in the REST API route registration within 'routes/rest/api.php'. The '/wp-json/formgent/responses/attachments' endpoint lacks authentication middleware, allowing unauthenticated remote attackers to delete files. On Linux servers where the default 'formgent' upload directory has not yet been created, path traversal protections can be bypassed. This enables the deletion of sensitive files such as 'wp-config.php', which can facilitate a complete site takeover by allowing an attacker to re-run the WordPress installation process. The issue is addressed in version 1.10.0.

Affected products

  • wpwax FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More up to, and including, 1.9.2

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References