A security flaw has been found in the FormGent plugin for WordPress, impacting all versions up to and including 1.9.2. The issue lets unauthenticated attackers (people without login access to your WordPress dashboard) delete files via an unsecured tool built into the plugin, with no login check required to use that tool.
At first, attackers can only delete files stored in the FormGent plugin's dedicated uploads folder. But if your site runs on a Linux server (the most common setup for WordPress hosting) and that specific uploads folder has not been created yet (the default state right after you install the plugin), the flaw lets attackers bypass built-in path protections to delete arbitrary files anywhere on your site.
This includes critical core WordPress files like wp-config.php, which holds your site's core configuration and database credentials. If an attacker deletes this file, they can take full control of your site by completing a fresh WordPress installation.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-3141