CVE-2026-3141: FormGent WordPress Auth Bypass Vulnerability

CVE-2026-3141 Overview

CVE-2026-3141 is a missing authorization vulnerability [CWE-862] in the FormGent plugin for WordPress. The flaw affects all versions up to and including 1.9.2. The /wp-json/formgent/responses/attachments REST API endpoint is registered in routes/rest/api.php without any authentication middleware or capability check. Unauthenticated attackers can invoke the endpoint to delete arbitrary files inside the formgent uploads directory. On Linux servers where wp-content/uploads/formgent does not yet exist, the plugin's path traversal protection can be bypassed. This allows deletion of files outside the intended directory, including wp-config.php, which enables a full site takeover through a fresh WordPress installation flow.

Critical Impact
Unauthenticated remote attackers can delete wp-config.php and trigger a fresh WordPress install to seize full administrative control of affected sites.

Affected Products

FormGent plugin for WordPress, all versions up to and including 1.9.2
WordPress sites deployed on Linux servers where wp-content/uploads/formgent has not been created
WordPress installations exposing the FormGent REST API route /wp-json/formgent/responses/attachments

Discovery Timeline

2026-08-01 - CVE-2026-3141 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-3141

Vulnerability Analysis

The FormGent plugin registers a REST API route for attachment management without an authentication or capability callback. The route handler in AttachmentController.php accepts a file path parameter and deletes the referenced file from the formgent uploads directory. Because WordPress REST routes default to open access when no permission_callback restricts them, any unauthenticated client can call the endpoint over the network. The handler applies a path traversal filter that assumes the target directory exists on disk. When wp-content/uploads/formgent is absent (the default state immediately after plugin activation), the sanitization logic fails to correctly resolve the base path, and traversal sequences escape the intended directory. Attackers can then supply relative paths that resolve to sensitive WordPress files, including wp-config.php. Deleting wp-config.php places the site into the WordPress installer state, allowing the attacker to bind the database to attacker-controlled credentials and provision a new administrator account.

Root Cause

The underlying defect is a missing capability check on a REST route (CWE-862). Registration in routes/rest/api.php does not supply a permission_callback, and the controller does not verify caller identity or capabilities before performing filesystem modifications. A secondary defect in the path traversal check depends on the existence of the target directory, breaking the sandbox on freshly installed plugins.

Attack Vector

Exploitation is remote, network-based, and requires no authentication or user interaction. An attacker sends a crafted HTTP request to /wp-json/formgent/responses/attachments referencing a target file with traversal segments. On vulnerable Linux hosts where the uploads subdirectory does not yet exist, the request results in deletion of the referenced file anywhere the web server user has write access. Deleting wp-config.php is the documented path to complete site takeover. Full technical details are available in the Wordfence Vulnerability Report and in the plugin source at the WordPress FormGent File Controller.

Detection Methods for CVE-2026-3141

Indicators of Compromise

HTTP requests to /wp-json/formgent/responses/attachments from unauthenticated sources, particularly with DELETE methods or path parameters containing ../ sequences.
Missing or recently deleted wp-config.php, .htaccess, or other files in the WordPress root, especially when accompanied by the WordPress installer prompt appearing on the site.
Creation of unexpected administrator accounts immediately following filesystem anomalies in the WordPress root.
Access log entries showing REST API calls to the FormGent attachment endpoint prior to site outages or defacement.

Detection Strategies

Alert on any REST API call to /wp-json/formgent/ endpoints that lacks a valid nonce or authenticated session cookie.
Monitor for path traversal patterns (../, encoded variants) in query strings and JSON bodies targeting FormGent routes.
Correlate WordPress installer page access with prior REST API activity to identify post-exploitation site hijacking.

Monitoring Recommendations

Enable WordPress and web server access logging with full URI and request body capture for /wp-json/ traffic.
Track file integrity for wp-config.php, .htaccess, and the WordPress core directory using a file integrity monitoring tool.
Review plugin inventory to identify hosts running FormGent versions at or below 1.9.2 and prioritize them for patching.

How to Mitigate CVE-2026-3141

Immediate Actions Required

Update the FormGent plugin to version 1.10.0 or later on all WordPress sites.
If patching is not immediately possible, deactivate and remove the FormGent plugin until the update can be applied.
Verify that wp-config.php and other WordPress core files are intact and audit recent changes in wp-content/uploads/formgent.
Rotate WordPress database credentials, secret keys, and administrator passwords if compromise is suspected.

Patch Information

The vendor fixed the vulnerability in FormGent 1.10.0. The corrective change is documented in the WordPress FormGent Changeset 3604540 and the version diff is available in the WordPress FormGent Version Change 1.9.2 to 1.10.0. The patch introduces a capability check on the attachment REST route and hardens the path sanitization logic so it no longer depends on the uploads subdirectory existing.

Workarounds

Block external access to /wp-json/formgent/responses/attachments at the web server or WAF layer until the plugin is updated.
Manually create the wp-content/uploads/formgent directory with restrictive permissions to reduce the traversal bypass surface on unpatched installs.
Restrict REST API access to authenticated users by enforcing authentication on the /wp-json/ namespace via a security plugin or reverse proxy rule.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~* ^/wp-json/formgent/responses/attachments {
    deny all;
    return 403;
}