FormGent Plugin: Critical Flaw Allows Site Takeover (CVE-2026-3141)

Published on 5 August 2026

A single unauthorised request from the internet can be enough to take over a WordPress website completely – with no login, no password, and without any staff member having to click on anything. That is precisely what a critical vulnerability in the WordPress plugin FormGent, an AI-powered form builder, makes possible. The flaw, identified as CVE-2026-3141, carries a CVSS score of 9.1 out of 10 and allows attackers to delete arbitrary files on the server – in the worst case the central configuration file wp-config.php. If this is removed, WordPress believes it has been freshly installed, and an attacker can link the site to their own database and make themselves an administrator.

If you are running FormGent in a version up to and including 1.9.2, you should act now. A security update is already available. We explain exactly what happened, how to check whether your site is affected, and what specific steps you need to take.

What happened?

On 31 July 2026, the security company Wordfence published a warning about a vulnerability in the FormGent plugin ("Next-Gen AI Form Builder") by the vendor wpWax. The flaw was discovered by security researchers Athiwat Tiprasaharn (Jitlada) and Itthidej Aramsri (Boeing777). One day later, on 1 August 2026, it was officially added to the US National Vulnerability Database (NVD).

The core of the problem: FormGent provides what is known as a REST API interface – a programming interface through which other programs can communicate with the plugin. The affected endpoint is /wp-json/formgent/responses/attachments and is actually meant to manage uploaded file attachments from form submissions. The problem: this interface was registered without any permission check whatsoever. Experts refer to this as "Missing Authorization" (CWE-862).

In plain terms, this means: any visitor on the internet – with no login at all – can call this interface and, via a parameter called file_token, specify files to be deleted. The plugin carries out the deletion without asking whether the requester is even authorised to do so.

The critical special case: deletion of wp-config.php

Normally, this flaw only allows the deletion of files within FormGent's upload directory – such as uploaded form attachments. That is already troublesome, but limited. It becomes truly dangerous through a second attack vector, known as path traversal (a trick used to break out of an intended folder).

On Linux servers where the directory wp-content/uploads/formgent does not yet exist, the built-in protection against this path traversal does not take effect. And this is precisely the default state immediately after plugin installation – namely for as long as no one has yet filled out a form with a file upload. At that moment, an attacker can use an input such as ../../wp-config.php to delete the central WordPress configuration file.

If wp-config.php is missing, WordPress automatically launches the installation wizard – as if the site had just been set up from scratch. An attacker can then use this wizard to connect the website to a database of their own, under their control, and set themselves up as an administrator. The result: a complete site takeover.

„The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2. […] enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.“

— Wordfence (Defiant Inc.), Advisory on CVE-2026-3141

How dangerous is the flaw really?

The vulnerability's CVSS vector reads like a worst-case scenario for site operators:

• AV:N (Network) – The attack is possible over the internet, remotely.
• AC:L (Low Complexity) – No special prerequisites are required.
• PR:N (No Privileges) – No login is needed.
• UI:N (No User Interaction) – No user has to click on anything.
• I:H / A:H – High impact on integrity (file manipulation) and availability (website outage).

This combination – remotely exploitable, no login required, no user click needed – makes the flaw ideal for automated mass attacks. That is exactly what security experts are warning about.

„Successful exploitation allows unauthenticated remote attackers to delete files on the target WordPress server. […] That condition can lead to complete site takeover by forcing the application into a fresh installation workflow that an attacker can then abuse.“

— Mallory.ai, Vulnerability Intelligence Platform

At the time of research (4 August 2026), no public exploits had yet been observed, and the flaw is not listed in the CISA catalogue of Known Exploited Vulnerabilities (KEV). But that is no reason to relax: according to the report State of WordPress Security in 2026 by Patchstack, the weighted median time from the publication of a vulnerability to its first mass exploitation is just five hours. Around half of such flaws are attacked within 24 hours, 70% within seven days. The window for automated attacks is therefore still open.

Who is affected?

Affected are all WordPress websites on which FormGent is installed in a version up to and including 1.9.2. According to Patchstack data, the plugin has around 1,000 active installations worldwide. Compared with large plugins, that is a manageable number – FormGent is still a relatively young plugin (available on WordPress.org since October 2024). For each individual affected operator, however, the risk of a complete takeover is at its maximum.

Freshly installed setups are particularly exposed: for as long as no one has submitted a form with a file upload, the FormGent upload directory does not exist – and that is precisely when the dangerous path traversal attack on wp-config.php is possible.

How to check whether your website is affected

1. Log in to your WordPress admin dashboard (your-domain.com/wp-admin).
2. In the left-hand menu, click Plugins → Installed Plugins.
3. Look for FormGent in the list. The version number is shown directly below the plugin name.
4. If the displayed version is 1.9.2 or older, your website is vulnerable. Versions from 1.10.0 onwards are safe.
5. Alternatively via the command line (WP-CLI): wp plugin get formgent --field=version. If "1.9.2" or lower is returned, action is required.

Checking for possible compromise

• Check your server logs for unusual DELETE requests to /wp-json/formgent/responses/attachments.
• Verify that the file wp-config.php is still present in the WordPress root directory.
• Check whether the WordPress installation wizard suddenly appears when you visit your website – a clear warning sign.
• Under Users → All Users, check whether any unknown administrator accounts have been created in recent days.

What you need to do now

The good news: a patch already exists. The vendor closed the flaw in version 1.10.0, released on 7 July 2026 – the patch adds a permission check to the affected endpoint and improves path validation. The most recent version is currently 1.11.0 (13 July 2026).

1. Update immediately (top priority): Update FormGent to version 1.10.0 or newer. This can be done via Plugins → Updates in the WordPress dashboard or manually via the WordPress.org plugin repository.
2. If an immediate update is not possible: Temporarily deactivate the plugin (Plugins → FormGent → Deactivate) until you can apply the update.
3. Harden the web server: Block access to /wp-json/formgent/responses/attachments for unauthenticated requests – via a Web Application Firewall (WAF, a protective layer in front of your website) or through your .htaccess or nginx configuration.
4. Neutralise the bypass vector: Ensure that the directory wp-content/uploads/formgent exists and has correct permissions (chmod 755). This eliminates the Linux-specific path traversal attack vector.
5. Create backups: Back up wp-config.php and the entire WordPress directory – and store the backup externally.
6. Enable monitoring: Monitor your access logs for DELETE requests to REST API endpoints. A security plugin such as Wordfence or Sucuri can help with this.
7. Check after the update: Verify that wp-config.php and other critical files are complete, and check all user accounts for unknown administrators.
8. Secure yourself long-term: Enable automatic plugin updates or establish a fixed update process. Subscribe to security newsletters from Wordfence or Patchstack.

Context: not an isolated case

This class of vulnerability – unauthenticated file deletion focused on wp-config.php – is a known and popular target among attackers. As recently as April 2026, the widely used plugin Perfmatters (CVE-2026-4350, CVSS 8.1) was hit, with 200,000 affected installations. Wordfence described the attack vector at the time as follows:

„Deleting wp-config.php forces the site into a setup state, allowing an attacker to initiate a site takeover by connecting it to a database under their control.“

— Wordfence on the Perfmatters case (CVE-2026-4350)

The plugin WP Travel Engine (CVE-2025-7526, October 2025) was affected too. FormGent itself had already had an earlier, similar flaw in October 2025 (in versions below 1.0.4). The patterns repeat themselves – and this underlines how important consistent update management is. For context: across the WordPress ecosystem, a total of 11,334 new vulnerabilities were discovered in 2025 (+42% compared with 2024), 91% of them in plugins.

GDPR: why the flaw is also legally sensitive

By its very nature, FormGent processes personal data – names, email addresses, phone numbers, sometimes payment data, and through file uploads potentially CVs, ID copies or photos as well. This makes the vulnerability not only a technical problem but also a data protection one.

• Notification obligation (Art. 33 GDPR): If personal data is compromised, deleted or made accessible without authorisation during an exploitation, a data breach has occurred. The controller must inform the competent supervisory authority without undue delay, if possible within 72 hours of becoming aware – unless a risk to the individuals concerned is unlikely.
• Communication obligation (Art. 34 GDPR): In the case of a high risk – for example the theft of sensitive form data or a complete site takeover – the affected individuals must additionally be informed.
• Liability risk (Art. 32 GDPR): Anyone who does not patch known vulnerabilities promptly risks breaching the obligation to implement appropriate technical and organisational measures.
• Fines (Art. 83 GDPR): Fines of up to 10 million euros or 2% of annual turnover are possible – for more serious infringements up to 20 million euros or 4%. In Germany, for example, a fine of 45 million euros was imposed on Vodafone in 2025. For smaller companies, even considerably lower sums can be existentially threatening.

To put the practical consequences in perspective: the average recovery costs after a WordPress hack for a small business amount to around 14,500 US dollars, according to Colorlib/Xictron (2026).

Conclusion

CVE-2026-3141 is one of the most dangerous WordPress plugin vulnerabilities of 2026: remotely exploitable, without a login, without user interaction – and with the potential for a complete website takeover. With around 1,000 installations, comparatively few sites are affected, but for each individual one the risk is at its maximum. Public exploits had not yet been observed at the time of research, but experience shows that such flaws are often attacked automatically within hours.

The recommended course of action is clear and simple: Update FormGent to version 1.10.0 or newer immediately. If an update is not possible right away, deactivate the plugin. Then check whether your site already shows signs of compromise. A clean, regular update process and a security plugin are the best protection against falling into the same trap next time – because, statistically, the next vulnerability of this kind is only a matter of time.