CVE-2025-10916: FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion
Published Oct 21, 2025
·Updated
The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Affected Software
1 affected component
FormGent WordPress plugin<1.0.4
Event History
Oct 21, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-10916?
CVE-2025-10916 is considered a high-severity vulnerability due to its potential for unauthorized file deletion.
2
How do I fix CVE-2025-10916?
To fix CVE-2025-10916, upgrade the FormGent WordPress plugin to version 1.0.4 or later.
3
Who is affected by CVE-2025-10916?
Websites using versions of the FormGent WordPress plugin before 1.0.4 are affected by CVE-2025-10916.
4
What type of attack does CVE-2025-10916 allow?
CVE-2025-10916 allows unauthenticated attackers to perform arbitrary file deletion on the server.
5
Is authentication required to exploit CVE-2025-10916?
No, CVE-2025-10916 can be exploited by attackers without any authentication.