FormGent WordPress Plugin Unauthenticated Arbitrary File Deletion (Site Takeover)

Technical Analysis

CVE-2026-3141 (CVSS 9.1) stems from the /wp-json/formgent/responses/attachments REST route being registered in routes/rest/api.php without any authentication or capability middleware, allowing unauthenticated actors to trigger file deletion within the formgent uploads directory. When the wp-content/uploads/formgent directory has not yet been created (the plugin's default post-install state), path traversal validation logic is bypassed, permitting deletion of arbitrary files outside the intended scope, including wp-config.php. Deleting wp-config.php reverts WordPress to its initial setup wizard, giving an attacker the ability to supply new database credentials and create an administrative account, resulting in complete site compromise. Exploitation requires no authentication, no user interaction, and can be automated at scale against internet-facing WordPress installations running the vulnerable plugin. This is a WordPress/CMS-specific issue with no direct AI agent runtime impact, though organizations running LLM-powered content generation, chatbot widgets, or RAG pipelines integrated into affected WordPress sites should be aware that a full site takeover could expose any embedded API keys, webhook secrets, or agent-integration credentials stored in the compromised environment.

Affected Systems

WordPress installations running the FormGent plugin version 1.9.2 and earlier, specifically on Linux-based hosting environments where the wp-content/uploads/formgent directory has not yet been created (default state immediately after plugin installation).

Indicators of Compromise

• Endpoint targeted: /wp-json/formgent/responses/attachments
• Target file: wp-content/wp-config.php
• Suspicious POST/DELETE requests to formgent REST routes without authenticated session cookies

Remediation Steps

1. 1

   Update FormGent Plugin

   Upgrade FormGent to the latest patched version beyond 1.9.2 as soon as it is released by the vendor.

2. 2

   Restrict REST API Access

   Implement WAF rules or server-level access controls to block unauthenticated requests to /wp-json/formgent/* endpoints until patched.

3. 3

   Verify Directory Existence

   Manually create the wp-content/uploads/formgent directory with correct permissions to eliminate the path traversal bypass condition.

4. 4

   Backup and Monitor wp-config.php

   Ensure wp-config.php is backed up securely and monitor for unexpected deletion or modification events.

5. 5

   Disable Plugin if Unpatched

   If no patch is available, temporarily deactivate FormGent on production sites to eliminate exposure.

6. 6

   Audit for Compromise

   Check for unauthorized administrator accounts, unexpected database credential changes, or a reset WordPress setup wizard state indicating prior exploitation.