The FormGent plugin for WordPress contains a path traversal flaw that allows an attacker to specify a pathname outside the intended directory, resulting in the deletion of arbitrary files on the server. This vulnerability falls under CWE-22 and can lead to loss of critical configuration or application files, compromising data integrity and availability. The effect is that any file on the web‑server that the web process can access may be permanently removed.

The wpWax FormGent plugin versions up to and including 1.5.6 are affected. The vulnerability applies to any installation of these versions on WordPress sites where the plugin’s file handling functions are exposed.

The CVSS score of 8.6 indicates a high‑severity flaw, but the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The attack vector is inferred to be remote, as the plugin is publicly accessible through normal WordPress site traffic; an attacker would need to submit a malicious input that includes directory traversal sequences to trigger the deletion. No evidence indicates the flaw is limited to authenticated users, so it is likely exploitable by anyone who can interact with the plugin’s form handler.