A security flaw has been found in the FormGent plugin for WordPress, impacting all versions up to and including 1.9.2. The issue comes from a missing authentication check on a specific plugin API endpoint, which lets unauthenticated attackers (people who do not have valid login credentials for your website) delete files stored in the FormGent plugin’s upload folder.
On Linux servers, this risk is worse if the default FormGent uploads folder has not been created yet, which is the standard state right after you install the plugin. In this scenario, attackers can bypass the built-in protection that normally keeps file deletions limited to the plugin’s upload folder, allowing them to delete any file on your server. This includes the critical wp-config.php file that WordPress requires to operate. Deleting this file can let an attacker fully take over your website by running a fresh WordPress installation.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-3141
