What is the CVSS score of CVE-2026-22460?

CVE-2026-22460 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2026-22460?

A critical path traversal vulnerability in wpWax FormGent (versions ≤1.4.2) could allow attackers to access sensitive files outside intended directories, potentially exposing confidential data or…

How to fix or mitigate CVE-2026-22460?

Within 24 hours: Audit all systems running FormGent ≤1.4.2 and disable the plugin if non-critical; document affected instances. Within 7 days: Implement WAF rules to block path traversal patterns (../, ..\, etc.) targeting FormGent endpoints; conduct file access logs review for suspicious activity. Within 30 days: Contact wpWax for patch ETA; evaluate alternative form plugins or plan controlled migration if patch remains unavailable.

Wordpress Plugin CVE-2026-22460

HIGH

Path Traversal (CWE-22)

2026-03-05 audit@patchstack.com

WordPress Path Traversal Wordpress Plugin

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.4.2.

AnalysisAI

Path traversal in wpWax FormGent plugin versions up to 1.4.2 enables unauthenticated remote attackers to access files outside intended directories. The vulnerability requires no user interaction and can be exploited over the network to cause denial of service or potentially disclose sensitive information. No patch is currently available for this high-severity issue.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects wpWax FormGent formgent. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.4.2.

Affected ProductsAI

Product: wpWax FormGent formgent.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.