CVE-2026-3141: FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress FormGent pluginto a version that resolves this vulnerability.Fixed in 1.9.2 - Compensating control
On Linux servers, ensure the wp-content/uploads/formgent directory exists (the default state after plugin installation may omit it); creating/maintaining the directory helps prevent bypass of path traversal protection that could enable deletion of arbitrary files such as wp-config.php.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3141?
CVE-2026-3141 has a critical severity rating of 9.1.
How do I fix CVE-2026-3141?
To fix CVE-2026-3141, update the FormGent plugin for WordPress to a version above 1.9.2.
What type of vulnerability is CVE-2026-3141?
CVE-2026-3141 is classified as a path traversal vulnerability.
What is affected by CVE-2026-3141?
CVE-2026-3141 affects the FormGent plugin for WordPress in versions 1.9.2 and below.
What impact does CVE-2026-3141 have?
CVE-2026-3141 allows unauthorized arbitrary file deletion via the 'file_token' parameter.