The FormGent plugin for WordPress contains a missing authorization check on its REST API route /wp-json/formgent/responses/attachments. This flaw allows anyone, including unauthenticated users, to delete files from the plugin’s uploads directory when the request includes a 'file_token' parameter. The operation can remove critical files such as wp-config.php, which, on a Linux server where the uploads directory has not yet been created, bypasses path‑traversal protection and permits a complete site takeover via a fresh WordPress installation. The weakness is a classic example of CWE‑862: Missing Authorization.

WordPress sites using the FormGent – Next‑Gen AI Form Builder for WordPress plugin, version 1.9.2 or earlier. The vulnerability exists in all releases up to and including 1.9.2 and is fixed in later versions such as 1.10.0.

With a CVSS score of 9.1 the flaw is classified as critical. The EPSS score is reported as less than 1 %, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the open REST API endpoint. Because no authentication is required and the payload can target arbitrary files under the uploads directory, the risk is high for confidentiality, integrity, and availability of affected WordPress sites.