# CVE-2026-3141: wpwax FormGent arbitrary file deletion in REST API

Source: https://junglewise.ai/threats/cve-2026-3141-wpwax-formgent-arbitrary-file-deletion-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-3141 · Severity: critical · CVSS 9.1 · Published 2026-08-01

FormGent, a WordPress plugin used for creating forms and quizzes, contains a security flaw that allows unauthorized individuals to delete files from the web server. In certain configurations, an attacker could delete critical system files like the site's configuration file. This could allow a malicious actor to reset the website and take full control of the entire WordPress installation, leading to a complete loss of data and site ownership.

Vendors: [wpWax](https://junglewise.ai/threats/vendors/wpwax).

## Quick answers

**Is CVE-2026-3141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3141 being exploited in the wild.

**How severe is CVE-2026-3141?** Critical severity, with a CVSS score of 9.1, published 1 August 2026.

**Which products and versions are affected?** wpWax FormGent up to, and including, 1.9.2.

**Is there a fix for CVE-2026-3141?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3141 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3141?** Check whether you run wpWax FormGent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FormGent plugin for WordPress (versions up to 1.9.2) is vulnerable to unauthorized arbitrary file deletion due to a missing capability check in the REST API route registration within 'routes/rest/api.php'. The '/wp-json/formgent/responses/attachments' endpoint lacks authentication middleware, allowing unauthenticated remote attackers to delete files. On Linux servers where the default 'formgent' upload directory has not yet been created, path traversal protections can be bypassed. This enables the deletion of sensitive files such as 'wp-config.php', which can facilitate a complete site takeover by allowing an attacker to re-run the WordPress installation process. The issue is addressed in version 1.10.0.

## Affected products

- wpwax FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More up to, and including, 1.9.2

## Timeline

- 2026-08-01: disclosed
- 2026-08-01: advisory

## References

- [https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/app/Http/Controllers/AttachmentController.php](https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/app/Http/Controllers/AttachmentController.php)
- [https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/routes/rest/api.php](https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/routes/rest/api.php)
- [https://plugins.trac.wordpress.org/browser/formgent/trunk/app/Http/Controllers/AttachmentController.php](https://plugins.trac.wordpress.org/browser/formgent/trunk/app/Http/Controllers/AttachmentController.php)
- [https://plugins.trac.wordpress.org/browser/formgent/trunk/routes/rest/api.php](https://plugins.trac.wordpress.org/browser/formgent/trunk/routes/rest/api.php)
- [https://plugins.trac.wordpress.org/changeset/3604540/formgent/trunk/app/Http/Controllers/AttachmentController.php](https://plugins.trac.wordpress.org/changeset/3604540/formgent/trunk/app/Http/Controllers/AttachmentController.php)
- [https://plugins.trac.wordpress.org/changeset?old_path=%2Fformgent/tags/1.9.2&new_path=%2Fformgent/tags/1.10.0](https://plugins.trac.wordpress.org/changeset?old_path=%2Fformgent/tags/1.9.2&new_path=%2Fformgent/tags/1.10.0)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c?source=cve)