Skip to content
eastbaycyber

CVE-2026-3141: Unauthenticated file deletion in FormGent WordPress plugin

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-08-01
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical unauthenticated file deletion in FormGent for WordPress affects versions up to 1.9.2. - Public-facing WordPress sites using the plugin should upgrade immediately and review logs. - Risk is urgent because NVD says wp-config.php deletion may enable full site takeover.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-3141
CVSS score 9.1 (Critical)
Attack vector Not explicitly provided in the NVD data retrieved for this research; defenders should treat it as remotely reachable because the issue is on a REST API endpoint
Auth required No. The flaw is described as unauthenticated due to missing capability/authentication checks
Patch available Yes, newer versions exist publicly. Affected range is up to and including 1.9.2. Exact first fixed version was not verified from primary-source advisory text retrieved here

This issue affects the FormGent WordPress plugin, formally listed on WordPress.org as “FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More” by wpWax. According to the NVD description, the vulnerable code exposes a REST endpoint that can be reached without the required capability or authentication enforcement.

For defenders, the immediate takeaway is simple: if you are running FormGent version 1.9.2 or earlier, assume the site is exposed until you update or disable the plugin. The reported impact is not limited to deleting plugin-generated uploads. Under specific Linux and default-install conditions described by NVD, an attacker may be able to delete arbitrary files, including wp-config.php, which can cascade into full WordPress takeover.

What Is This Vulnerability?

At its core, CVE-2026-3141 is an authorization failure on a REST API route. The NVD record states that the endpoint /wp-json/formgent/responses/attachments was registered without appropriate authentication middleware or capability checks in routes/rest/api.php. That means a remote, unauthenticated user may be able to trigger file deletion logic intended for legitimate application workflows.

The primary impact described is arbitrary file deletion within the plugin’s upload directory. That alone is serious because it can destroy evidence, remove submitted files, break workflows, or disrupt business processes using the form system. But the more severe aspect is the path-handling edge case described in the CVE text: on Linux servers where wp-content/uploads/formgent does not yet exist, the plugin’s path traversal protection can reportedly be bypassed. In that state, an attacker may be able to delete files outside the intended directory.

Technical Notes

The NVD references point to these code locations in the WordPress plugin repository:

  • routes/rest/api.php
  • app/Http/Controllers/AttachmentController.php

Direct retrieval of those referenced lines was not possible in this research environment because the Trac URLs returned HTTP 403. Even so, the NVD description is explicit enough to establish the root cause: the REST route lacked required access control, and the deletion logic could be reached by unauthenticated callers.

A representative exposed route pattern for defenders to monitor is:

POST /wp-json/formgent/responses/attachments HTTP/1.1
Host: example.com
User-Agent: curl/8.0
Content-Type: application/json
AnalystImpact · assess the risk

Who Is Affected?

The confirmed affected product is the FormGent WordPress plugin from wpWax. The NVD description states the vulnerability affects all versions up to and including 1.9.2. That wording is important because it indicates the flaw is not limited to a narrow build or single branch. If your asset inventory only tracks plugin presence and not exact version, you should treat all FormGent installations as requiring review until version data is verified.

The plugin listing observed during research showed a current public version of 1.11.0 on WordPress.org. That strongly suggests an updated build is available to remediate the issue. However, the exact first fixed version number was not explicitly confirmed in the primary-source material retrieved here. Because the task requires accuracy over guesswork, the safest guidance is to upgrade directly to the latest available version, not merely to the nearest version above 1.9.2.

Organizations most exposed are those with: - Internet-accessible WordPress sites - FormGent installed at 1.9.2 or earlier - Linux hosting environments - Sites where the plugin upload directory may still be in its default state - Weak change monitoring around core files such as wp-config.php

Managed WordPress providers, SMB web teams, and agencies with many client sites should pay particular attention. This is the kind of bug that can be mass-scanned if the REST route is reachable and plugin fingerprinting is possible.

CVSS Score Breakdown

The reported CVSS v3.x base score is 9.1, which places this vulnerability in the Critical range. The full vector string was not included in the NVD data returned during this research session, so it would be inappropriate to invent one. Still, the score aligns with the reported characteristics: no authentication requirement, remotely accessible web endpoint, and potentially severe integrity and availability impacts with a plausible path to full compromise.

Why would a file deletion bug score this high? Because the business impact is not just data loss inside a plugin folder. The NVD description explicitly says that in some cases an attacker may delete wp-config.php. On a WordPress deployment, that is a high-value target. If removed, the site can enter a setup or reinstall state that may let an attacker bind the application to infrastructure under their control or otherwise seize administrative control.

In practical terms, defenders should interpret the 9.1 score as meaning: - The barrier to exploitation is low if the endpoint is reachable. - Attack consequences can be severe even without code execution. - The issue deserves accelerated patching similar to other high-risk WordPress plugin flaws.

Because the exact vector string was unavailable here, defenders should assume worst-case exposure until proven otherwise and prioritize verification, containment, and upgrades accordingly.

Exploitation Status

At the time of this write-up, active exploitation in the wild is not confirmed from the sources reviewed. Specifically, this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. That is useful context, but it should not be misread as a safety signal. KEV absence only means there is no CISA catalog listing at this time, not that attackers are ignoring the issue.

Likewise, no verified public proof-of-concept (PoC) for CVE-2026-3141 was confirmed during this research session. Search results surfaced unrelated CVEs with similar numbering, but no clearly attributable GitHub PoC or vendor-published exploit steps for this exact issue were verified. In other words, current status is:

  • PoC public? Not verified from sources retrieved here
  • Active exploitation? Not confirmed
  • CISA KEV listed? No

That said, the exploitation path described by NVD appears straightforward conceptually: a REST endpoint lacking authentication controls invokes file deletion logic. Even without a published PoC, defenders should assume that competent attackers can reproduce the behavior quickly from the CVE description alone.

ResponderRunbook · act now

How to Detect It

Detection should focus on three areas: requests to the exposed REST route, unexpected file deletions in the FormGent upload path, and integrity changes involving wp-config.php. Web access logs, WordPress logs, EDR file telemetry, and host-level audit logs can all help. Because the vulnerability is unauthenticated, suspicious requests may appear without a valid WordPress login sequence or established admin session.

On Linux systems, also inspect for fresh WordPress setup flows after unexplained outages or configuration errors. If wp-config.php was deleted, administrators may see WordPress installation prompts, PHP include failures, or abrupt site state changes. These are high-signal indicators that warrant incident response, not just routine troubleshooting.

Technical Notes

Example access log pattern to hunt for REST route abuse:

/wp-json/formgent/responses/attachments

Example grep against common web logs:

grep -R "/wp-json/formgent/responses/attachments" /var/log/nginx /var/log/apache2 2>/dev/null

Example suspicious request review with common status and source fields:

awk '/\/wp-json\/formgent\/responses\/attachments/ {print $1, $4, $6, $7, $9, $12}' /var/log/nginx/access.log

Example Splunk query:

index=web sourcetype IN (nginx, apache, apache_access)
"/wp-json/formgent/responses/attachments"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) values(http_user_agent) by src_ip, host, uri_path

Example Sigma-style idea for suspicious REST access without prior authentication context:

title: FormGent REST Attachment Endpoint Access
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: "/wp-json/formgent/responses/attachments"
  condition: selection
level: high

Host-side checks for potentially destructive impact:

ls -l wp-config.php
find wp-content/uploads -maxdepth 2 -type d -name formgent -ls

If the site unexpectedly presents the WordPress installation workflow, treat that as a possible indicator of wp-config.php deletion and begin forensic preservation before restoring service.

Mitigation and Patching

The confirmed vulnerable range is all FormGent versions up to and including 1.9.2. The safest action is to upgrade to the latest available FormGent version on WordPress.org, which was observed as 1.11.0 during this research. Because the exact first fixed version was not explicitly verified in the primary-source content retrieved here, it is better to move to the newest available release than to target an inferred minimum fixed build.

If you cannot patch immediately, the compensating controls are imperfect but still useful: - Disable the plugin until maintenance is possible. - Restrict public access to the site or to REST routes where operationally feasible. - Monitor and alert on access to /wp-json/formgent/responses/attachments. - Verify the presence and integrity of wp-config.php. - Ensure you have recent backups before making changes.

Do not rely on obscurity or assume that the lack of a public PoC buys time. WordPress plugin bugs tied to unauthenticated REST endpoints tend to be easy to validate once disclosed.

Technical Notes

Upgrade using WP-CLI:

wp plugin update formgent
wp plugin status formgent

If you need to disable first:

wp plugin deactivate formgent

If WP-CLI is unavailable, update through the WordPress admin plugin manager and verify the installed version afterward.

Short-term web server blocking can reduce exposure if the plugin cannot be upgraded immediately. Example Nginx rule:

location = /wp-json/formgent/responses/attachments {
    deny all;
    return 403;
}

Example Apache configuration:

<Location "/wp-json/formgent/responses/attachments">
    Require all denied
</Location>

These are temporary workarounds, not substitutes for upgrading. After patching, validate that: 1. The plugin version is above 1.9.2 2. The REST endpoint is no longer callable without proper authorization 3. wp-config.php exists and matches expected integrity baselines 4. No suspicious administrative changes occurred during the exposure window

References

Primary authoritative references for this CVE include the NVD record and the WordPress.org plugin listing. The NVD entry provides the essential facts used here: affected range, root cause, vulnerable endpoint, and the high-impact wp-config.php deletion scenario. The WordPress.org listing confirms the official plugin name, developer, and the existence of newer public versions.

Additional references from the NVD record point to WordPress plugin repository files and a changeset likely related to remediation. Those code links could not be directly fetched in this environment due to HTTP 403 responses, so they are included here as source references rather than quoted code evidence.

For defenders needing a concise decision point: if FormGent is installed and the version is 1.9.2 or earlier, patch to the latest available release immediately, review logs for access to the vulnerable REST endpoint, and confirm wp-config.php integrity before declaring the site safe.

For further reading on WordPress plugin security, check out our articles on CVE-2026-1609 and CVE-2026-57624.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-08-01

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.