A security flaw has been found in the FormGent plugin for WordPress, a tool some site owners use to handle form submissions and file uploads, impacting all versions up to and including 1.9.2. The issue exists because a public API endpoint the plugin uses to manage uploaded files does not require any login or verification to access, which lets unauthenticated third parties delete files stored in the plugin’s dedicated uploads folder.
On Linux servers, if the plugin’s default uploads folder has not yet been created (the standard state right after installing the plugin), attackers can bypass built-in path protection to delete arbitrary files across your site. This includes critical files like wp-config.php, which holds your site’s core configuration data; deleting this file can let an attacker fully take over your WordPress site by running a new site installation.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-3141