CVE-2026-3141
CRITICAL
CVSS 9.1
formgent_next_gen_ai_form_builder_for_wordpress_with_multi_step_quizzes_payments_more
Verified Advisory
Missing authorization to unauthenticated arbitrary file deletion in FormGent plugin for WordPress (CVE-2026-3141)
PHP
WordPress
Authentication Bypass
Path Traversal
Wordpress Plugin
Formgent Next Gen Ai Form Builder For Wordpress With Multi Step Quizzes Payments More
Wpwax
The FormGent plugin for WordPress fails to enforce capability checks on the `/wp-json/formgent/responses/attachments` REST API endpoint, which is registered without authentication middleware. Unauthenticated attackers can delete arbitrary files within the formgent uploads directory. On Linux servers where the `wp-content/uploads/formgent` directory does not yet exist, path traversal protections can be bypassed, permitting deletion of arbitrary files including `wp-config.php` and enabling complete site takeover via a fresh WordPress installation.
Affected versions:
- <= 1.9.2
We recommend updating to: 1.10.0.
CVSS 9.1 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c?source=cve
Details: https://vuln.today/cve/CVE-2026-3141
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.9.2
Fixed in: 1.10.0