CVE-2026-3141 wpwax CVE debrief

Who should care

WordPress administrators and users of the FormGent plugin should be aware of this critical vulnerability and take immediate action to update the plugin and monitor their sites for suspicious activity.

Technical summary

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint. This allows unauthenticated attackers to delete arbitrary files within the formgent uploads directory. On Linux servers, the path traversal protection can be bypassed, enabling deletion of arbitrary files, including wp-config.php, which can lead to complete site takeover via a fresh WordPress installation.

Defensive priority

High priority due to critical CVSS score and potential for complete site takeover.

Recommended defensive actions

• Immediately update the FormGent plugin to version 1.10.0 or later.
• Verify that the wp-content/uploads/formgent directory exists and is properly configured.
• Monitor server logs for suspicious file deletion activity.
• Consider implementing additional security measures, such as restricting access to the REST API endpoint.
• Perform a thorough review of the server's file system to identify potential vulnerabilities.
• Implement a Web Application Firewall (WAF) to detect and prevent suspicious activity.
• Regularly review and update the plugin to ensure the latest security patches are applied.

Evidence notes

Evidence from the NVD and Wordfence sources indicates a critical vulnerability in the FormGent plugin for WordPress. The vulnerability exists due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint, allowing unauthenticated attackers to delete arbitrary files.

Official resources