EUVD-2026-51725
GHSA-68f5-7j6g-q5r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); file deletion yields high integrity and availability impact but no data disclosure (C:N/I:H/A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
Articles & Coverage 1
AnalysisAI
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Technical ContextAI
The vulnerability lives in a WordPress plugin's REST API layer. WordPress exposes plugin routes under /wp-json/, and each route should attach a permission_callback to enforce a capability check before executing the handler. Here the attachment-deletion route defined in routes/rest/api.php was registered without any authentication/authorization middleware, and the AttachmentController delete handler performs no capability verification - the textbook CWE-862 (Missing Authorization) root cause. A secondary weakness is a path-traversal sanitization step that assumes the formgent uploads directory already exists; when it does not (default state after install), the normalization/containment check fails open, allowing traversal above the intended uploads path. The CPE identifies the affected component as wpwax's 'FormGent - Next-Gen AI Form Builder for WordPress'. Deleting wp-config.php is the pivotal detail: WordPress treats a missing config file as an un-installed site and serves the setup wizard, which an attacker can complete to point the site at an attacker-controlled database.
RemediationAI
Vendor-released patch: 1.10.0 - update the FormGent plugin to version 1.10.0 or later, which adds the missing authorization/permission check to the attachments REST route (see the fix changeset https://plugins.trac.wordpress.org/changeset/3604540/formgent/trunk/app/Http/Controllers/AttachmentController.php). If immediate patching is not possible, compensating controls include blocking or restricting external access to the /wp-json/formgent/responses/attachments endpoint at a WAF or reverse proxy (trade-off: may break legitimate FormGent attachment handling), or fully deactivating and removing the FormGent plugin until it can be updated (trade-off: form functionality is lost). As a mitigating measure against the traversal-to-takeover path, ensure the wp-content/uploads/formgent directory exists with correct ownership so the path-containment check operates as intended, and confirm wp-config.php file permissions/backups are in place; note this hardens but does not fully close the missing-authorization flaw, so it is a stopgap only. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c) for detection guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today