CVE-2026-3141: 
WordPress vulnerability analysis and mitigation

CVE-2026-3141 is an unauthorized arbitrary file deletion vulnerability in the FormGent – Next-Gen AI Form Builder plugin for WordPress, developed by wpWax. The flaw exists in all versions up to and including 1.9.2, where the /wp-json/formgent/responses/attachments REST API endpoint is registered without any authentication middleware, allowing unauthenticated attackers to delete files. On Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default post-installation state), path traversal protections can be bypassed, enabling deletion of arbitrary files including wp-config.php and potential complete site takeover. The vulnerability was published on August 1, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical), assigned by Wordfence (Wordfence, GitHub Advisory).

The root cause is a missing authorization check (CWE-862) on the REST API route registered in routes/rest/api.php, which lacks any authentication middleware, allowing any unauthenticated network request to invoke the attachment deletion logic in app/Http/Controllers/AttachmentController.php. Under normal conditions, file deletion is constrained to the wp-content/uploads/formgent directory; however, on Linux systems where this directory has not yet been created (the default state immediately after plugin installation), the path traversal guard fails, enabling attackers to supply ../ sequences to reach arbitrary filesystem paths. This allows deletion of critical files such as wp-config.php, which — when removed — triggers WordPress's installation wizard, enabling an attacker to reconfigure the site with their own database credentials and achieve full site takeover (Wordfence, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary files on the WordPress server, with the most severe scenario being deletion of wp-config.php on Linux installations where the FormGent upload directory has not been initialized. This leads to complete site takeover, as the absence of wp-config.php causes WordPress to present the installation wizard, allowing the attacker to connect the site to an attacker-controlled database. While confidentiality impact is rated None (no direct data exfiltration), integrity and availability are both rated High, reflecting the ability to destroy site configuration and render the site inoperable or fully compromised (Wordfence, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the FormGent plugin (versions ≤ 1.9.2) using passive techniques such as checking wp-content/plugins/formgent/ paths, HTTP response headers, or plugin enumeration tools like WPScan.
2. Verify vulnerable state: Confirm the target is a Linux server and that the wp-content/uploads/formgent directory does not exist (default post-installation state), which enables path traversal bypass.
3. Craft malicious DELETE request: Send an unauthenticated HTTP DELETE or POST request to the /wp-json/formgent/responses/attachments REST API endpoint, including a path traversal payload (e.g., ../../wp-config.php) as the target file parameter.
4. Trigger path traversal: Because the upload directory does not exist, the path traversal protection fails, and the AttachmentController.php processes the traversal sequence, deleting the specified file outside the intended directory.
5. Delete wp-config.php: Successfully delete wp-config.php from the WordPress root, causing WordPress to lose its database configuration.
6. Trigger installation wizard: Access the WordPress site in a browser; without wp-config.php, WordPress presents the fresh installation wizard.
7. Complete site takeover: Supply attacker-controlled database credentials through the installation wizard to gain full administrative control of the WordPress instance (Wordfence, GitHub Advisory).

• Network: Unexpected HTTP DELETE or POST requests to /wp-json/formgent/responses/attachments from unauthenticated sources; requests containing ../ or URL-encoded path traversal sequences (%2e%2e%2f) in file parameters.
• Logs: Web server access logs showing requests to the FormGent REST API endpoint from unknown or suspicious IPs without authentication tokens; WordPress debug logs indicating missing or inaccessible wp-config.php.
• File System: Absence of wp-config.php in the WordPress root directory; unexpected deletion of files within or outside wp-content/uploads/formgent/; presence of a new wp-config.php created after the original was deleted (indicating attacker re-installation).
• Process/Application: WordPress presenting the installation wizard (/wp-admin/setup-config.php) to visitors, indicating wp-config.php has been removed; unexpected new WordPress admin accounts created post-incident.

The vulnerability is patched in FormGent version 1.10.0; users should update immediately from the WordPress plugin repository (WordPress Changeset). As a workaround prior to patching, administrators on Linux servers should manually create the wp-content/uploads/formgent directory with appropriate permissions to prevent path traversal exploitation. Additionally, restricting web server process permissions and implementing WAF rules to block unauthenticated requests to the /wp-json/formgent/responses/attachments endpoint can reduce exposure. Backing up wp-config.php and monitoring for its unexpected deletion is also recommended (Wordfence).

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the advisory on August 1, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified at this time (Wordfence).