CVE-2026-22460: 
WordPress vulnerability analysis and mitigation

CVE-2026-22460 is a Path Traversal vulnerability (CWE-22) in the wpWax FormGent WordPress plugin that allows unauthenticated remote attackers to access files outside of intended directories, with a primary impact on availability. The vulnerability affects FormGent versions up to and including 1.5.6 (per NVD) or 1.4.2 (per ENISA/Patchstack). It was published on March 5, 2026, and assigned a CVSS v3.1 base score of 8.6 (High) (Feedly, Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient validation of user-supplied file path inputs within the FormGent plugin. An unauthenticated attacker can craft network requests containing path traversal sequences (e.g., ../) to escape the plugin's intended directory scope and interact with arbitrary files on the server. No authentication or user interaction is required, and the attack complexity is low, making it straightforward to exploit over the network. The vulnerability is also associated with CAPEC patterns including CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding), and CAPEC-76 (Manipulating Web Input to File System Calls) (Feedly).

Exploitation of this vulnerability can result in high availability impact with a changed scope, suggesting the attacker can affect resources beyond the vulnerable component itself — potentially causing arbitrary file deletion or disruption of server-side files outside the plugin's directory. While the CVSS score reflects no direct confidentiality or integrity impact, successful path traversal could expose sensitive server files such as configuration files and database credentials, enabling further system compromise (Feedly, Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-22460. The EPSS score is approximately 0.021% (0.000210), indicating a low probability of exploitation in the near term. The vulnerability was assigned by Patchstack and has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Organizations running wpWax FormGent should immediately audit their WordPress installations and identify any instances running version 1.5.6 or earlier. As no patch information was confirmed available at the time of disclosure, administrators should contact wpWax directly for an updated version addressing this vulnerability. In the interim, deploying web application firewall (WAF) rules to detect and block path traversal sequences (e.g., ../, %2e%2e/) targeting the FormGent plugin endpoints is recommended. Restricting access to FormGent functionality to authenticated and trusted users only can further reduce the attack surface (Feedly).

Wordfence included CVE-2026-22460 in their weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). Qualys also listed the vulnerability in their April 2026 application security detections publication (Qualys). No significant vendor statements or notable researcher commentary beyond these routine tracking reports have been observed.