A security vulnerability has been identified in the FormGent plugin for WordPress, affecting all versions up to and including 1.9.2. The flaw exists in the plugin's feature for managing form attachment files: this feature does not require users to prove they have authorized access to your site before it operates. As a result, unauthenticated third parties can exploit this flaw to delete any files stored in the FormGent plugin's dedicated uploads folder on your site.
For sites hosted on Linux servers, the risk is far more severe if the plugin's default upload directory has not yet been created, which is the default state immediately after installing the plugin. In this scenario, attackers can bypass the plugin's built-in safeguards to delete almost any file on your site, including the wp-config.php file that holds your site's core configuration and login credentials. If an attacker deletes this critical file, they can run a fresh WordPress installation on your site and take full, unauthorized control of it.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-3141