CVE-2026-3141

Published: Ago 01, 2026 Last Modified: Ago 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: high

Description

AI Translation Available

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0047
Percentile
0,4th
Updated

EPSS Score Trend (Last 2 Days)

862

Missing Authorization

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control Availability
Potential Impacts:
Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Bypass Protection Mechanism Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)
Applicable Platforms
Technologies: AI/ML, Web Server, Database Server, Not Technology-Specific
Likelihood of Exploit: High
View CWE Details
https://plugins.trac.wordpress.org/browser/formgent/tags/1.…
https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/app/Http/Control…
https://plugins.trac.wordpress.org/browser/formgent/tags/1.…
https://plugins.trac.wordpress.org/browser/formgent/tags/1.3.1/routes/rest/api.…
https://plugins.trac.wordpress.org/browser/formgent/trunk/a…
https://plugins.trac.wordpress.org/browser/formgent/trunk/app/Http/Controllers/…
https://plugins.trac.wordpress.org/browser/formgent/trunk/r…
https://plugins.trac.wordpress.org/browser/formgent/trunk/routes/rest/api.php#L…
https://plugins.trac.wordpress.org/changeset/3604540/formge…
https://plugins.trac.wordpress.org/changeset/3604540/formgent/trunk/app/Http/Co…
https://plugins.trac.wordpress.org/changeset?old_path=%2Ffo…
https://plugins.trac.wordpress.org/changeset?old_path=%2Fformgent/tags/1.9.2&ne…
https://www.wordfence.com/threat-intel/vulnerabilities/id/0…
https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-90…