FormGent CVE-2026-94499

Requires a valid authenticated WordPress account at subscriber level or higher (PR:L) on a site running FormGent plugin version 1.12.2 or earlier; no user interaction and no special configuration are needed once such an account exists. The practical enabler is open user self-registration (a common WordPress setting), which lets an attacker obtain the required subscriber account at will; sites that disable registration or restrict account creation raise the bar significantly. The limiting factor is the plugin's niche deployment footprint and the requirement for at least subscriber authentication rather than fully unauthenticated access.

This is a moderate-priority authorization flaw whose real-world risk is meaningfully lower than its 7.1 CVSS score suggests. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) shows a network-reachable, low-complexity issue requiring only low-privilege (subscriber-level) authentication and no user interaction, with high confidentiality impact and minor integrity impact - the score is driven almost entirely by C:H. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single Patchstack reference confirms the vulnerability class (broken access control, CWE-862) but provides a sparse description that does not name the specific affected endpoint or the exact data exposed, so the C:H rating cannot be independently corroborated against a concrete data set. The main limiting factors are that any WordPress site allowing open user registration exposes subscriber accounts trivially, which raises reachability, but the affected product is a niche form-builder plugin with a small deployment footprint, which caps aggregate real-world exposure. Net: a real but not urgent issue - patch on a normal cadence rather than as an emergency.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running FormGent <= 1.12.2, then sends a crafted authenticated request to a plugin function that lacks a proper capability check, retrieving form data or configuration the subscriber role should not be able to read. Because attack complexity is low and no user interaction is required, this can be scripted against any reachable site. No public proof-of-concept exploit was identified at time of analysis.