The FormGent – Next-Gen AI Form Builder plugin for WordPress suffers from a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to 1.9.2. The REST API route is registered without authentication middleware, enabling unauthenticated attackers to delete arbitrary files in the formgent uploads directory. Furthermore, on Linux servers where the wp-content/uploads/formgent directory is absent (default after installation), path traversal protections can be bypassed, allowing deletion of critical files such as wp-config.php. This vulnerability is tracked as CVE-2026-3141 and is classified under CWE-862 (Missing Authorization).

An unauthenticated attacker can delete arbitrary files within the plugin's upload directory, causing denial of service or data loss. On Linux systems without the uploads directory present, the attacker can bypass path traversal protections to delete critical WordPress files like wp-config.php, which can lead to complete site takeover via a fresh WordPress installation. The CVSS score of 9.1 reflects the critical nature of this vulnerability with high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoint if possible, and monitor for unusual file deletions. Avoid running the plugin on servers where the uploads directory is missing or ensure the directory exists with proper permissions to mitigate path traversal exploitation.