FormGent EUVD-2026-51725

Exploitation requires network access to the WordPress REST API path /wp-json/formgent/responses/attachments on a site running FormGent version 1.9.2 or earlier; no authentication, credentials, or user interaction are needed (PR:N/UI:N). Deletion is normally constrained to files within the wp-content/uploads/formgent directory. The escalation to arbitrary-file deletion and full site takeover additionally requires a Linux server AND that the wp-content/uploads/formgent directory does not yet exist - the default state immediately after plugin installation - which disables the path-traversal protection. Limiting factors: on hosts where that directory already exists, or on non-Linux platforms behaving differently, impact is bounded to the formgent uploads directory rather than wp-config.php; the site-takeover chain also depends on WordPress serving its setup wizard once wp-config.php is removed.

The signals are consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and high integrity/availability impact - the maximal exposure profile short of confidentiality loss. No EPSS score was provided in the input, so exploitation-probability modeling cannot be cited here; treat that as a gap rather than a low-risk indicator. The flaw is NOT in CISA KEV and no public POC was supplied, so there is currently no evidence of active exploitation or weaponization - the risk is potential, not observed. No SSVC decision record was provided. The chief caveat is conditional: full site takeover requires the Linux + non-existent-formgent-directory precondition; where that directory already exists, impact is limited to deletion of files within the formgent uploads path. Because the vulnerable directory is absent by default immediately after install, the worst case is realistically reachable on many fresh deployments.

An attacker sends an unauthenticated HTTP request to /wp-json/formgent/responses/attachments on a target WordPress site running FormGent ≤ 1.9.2, specifying a traversal path to delete wp-config.php on a Linux host where the formgent uploads directory has not been created. With the config file gone, WordPress serves its install wizard, letting the attacker re-initialize the site against a database they control and seize full administrative control. No public POC was provided, but the network vector and low complexity make exploitation straightforward to reproduce.