CVE-2026-3141 FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter

Q: What is CVE-2026-3141?

CVE-2026-3141 is a critical missing authorization vulnerability in wpwax FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2026-3141 being exploited?

There is no known exploitation of CVE-2026-3141 in the wild and no public exploit code.

Q: How do I fix CVE-2026-3141?

No fix has been published for CVE-2026-3141 yet. Limit exposure of the affected software until one is available.

Critical 9.1 Published 1 Aug 2026 Updated 3 Aug 2026

Unauthenticated attackers can delete arbitrary files, potentially leading to site takeover, due to missing authorization checks in the FormGent WordPress plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-3141?

CVE-2026-3141 is a critical missing authorization vulnerability in wpwax FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.

Weakness: CWE-862

Which versions are affected by CVE-2026-3141?

How do I fix CVE-2026-3141?

No fix has been published for CVE-2026-3141 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-3141 being exploited?