The vulnerability identified as CVE-2026-22460 in the wpWax FormGent plugin involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. This allows an attacker to manipulate file paths to access files and directories outside the intended scope. The affected versions are up to and including 1.5.6. The CVSS v3.1 score is 8.6, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is limited to availability, with no confidentiality or integrity impact reported. No patch or remediation information is currently available.

The vulnerability allows an attacker to perform path traversal attacks, potentially causing denial of service or other availability impacts on the affected system. There is no reported impact on confidentiality or integrity. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.