External risk intelligence

WordPress FormGent Plugin Arbitrary File Deletion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-3141

The vulnerability resides in a WordPress plugin's REST API endpoint, which is exposed to the public internet by default in any WordPress installation. As a web-facing API endpoint accessible without authentication, it is inherently reachable from the internet.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The FormGent WordPress plugin has a critical vulnerability that allows unauthenticated attackers to delete arbitrary files. In some configurations, this could enable complete site takeover. The main concern is confirming relevance and exposure.

Plugin flaw lets attackers delete files.
Site takeover possible by unauthenticated attackers.
Confirm plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can delete arbitrary files by sending a request to a vulnerable REST API endpoint exposed by the FormGent plugin. If the plugin's upload directory hasn't been created yet on a Linux server, this could allow deletion of critical files like `wp-config.php`, enabling a complete site takeover.

No authentication required to access endpoint.
REST API endpoint triggers file deletion.
Risk of arbitrary file deletion and site takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete arbitrary files within the WordPress site's upload directory, including critical configuration files like `wp-config.php` on certain server setups. This could lead to a complete website takeover when supported by the advisory.

Arbitrary file deletion, including `wp-config.php`.
Unauthenticated REST API endpoint access.
Complete website takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in the FormGent WordPress plugin. The first practical step is to identify all WordPress instances using the plugin, confirm their reachability, and determine if they host critical business data. Once identified, accountable owners should be engaged to plan remediation based on the assessed risk and potential impact.

WordPress application owners should manage remediation.
Verify plugin usage and exposure across all sites.
Plan and execute mitigation or removal.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FormGent plugin for WordPress?

FormGent is a WordPress plugin designed to help site administrators manage and organize responses and attachments submitted through web forms. It functions by creating specific paths on your server to store these uploaded files, integrating with the WordPress REST API to handle data transfers between the user interface and the backend storage.

What does CVE-2026-3141 mean for security?

This vulnerability is classified as CWE-862, which stands for Missing Authorization. In simple terms, the plugin fails to check if a person visiting the site has permission to delete files. Because the code lacks the necessary security gatekeeper, it treats every incoming request as if it were authorized, allowing anyone to trigger a file deletion command.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specific request to the plugin's REST API endpoint. The vulnerability is present regardless of whether the attacker is logged in. Note that simply having the plugin installed does not guarantee the worst outcome; the potential for deleting core files like wp-config.php specifically depends on the server environment, such as specific Linux configurations where the expected uploads directory is missing.

Why does Halo Surface Signal flag this as reachable?

Halo Surface Signal identifies this as a significant concern because the vulnerable code resides within a WordPress REST API endpoint. By design, WordPress makes these endpoints accessible to the public internet so that site features can function, meaning this flaw is reachable from any web browser or automated tool without needing to bypass a login page.

Do I need to take action if I use this plugin?

Yes. Start by creating an inventory of all WordPress sites you manage to determine where FormGent is active. Once you have identified the installations, prioritize them for updates or removal. Engage your technical team to ensure that the plugin is either updated to a version that includes the necessary authorization checks or removed from the environment to eliminate the risk of unauthorized file deletion.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.