The FormGent plugin for WordPress contains a path traversal flaw known as Improper Limitation of a Pathname to a Restricted Directory. This vulnerability allows an attacker to specify a pathname outside the intended directory, which can lead to deletion of arbitrary files on the server. Falling under CWE-22, the flaw threatens critical configuration or application files, compromising data integrity and availability. Any file that the web process can access may be permanently removed.

The wpWax FormGent plugin versions up to and including 1.7.0 are affected. The vulnerability applies to any installation of these versions on WordPress sites where the plugin’s file handling functions are exposed.

The CVSS score of 8.6 indicates a high‑severity flaw, but the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The likely attack vector is remote, as the plugin is publicly accessible through normal WordPress site traffic; an attacker would need to submit a malicious input that includes directory traversal sequences to trigger the deletion. No evidence indicates the flaw is limited to authenticated users, so it is likely exploitable by anyone who can interact with the plugin’s form handler.