A critical vulnerability in the FormGent WordPress plugin allows unauthenticated attackers to perform arbitrary file deletion, posing a severe risk of complete site takeover.

This is an improper authorization vulnerability (CWE-862) occurring because the REST API endpoint for attachments lacks authentication middleware. An unauthenticated attacker can manipulate file paths to delete sensitive system files.

Successful exploitation permits the deletion of essential configuration files, including wp-config.php. This can force a site into a fresh installation state, resulting in total loss of site control, data destruction, and significant business disruption. The CVSS score of 9.1 reflects the high impact on integrity and availability.

Immediate Action: Update the FormGent plugin to version 1.10.0 or the latest available release immediately.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests directed at the /wp-json/formgent/responses/attachments endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected REST API route until the plugin can be patched.

Public Exploit Available: No (exploit_available: false)

Given the critical severity and the potential for full site compromise, administrators must prioritize updating the FormGent plugin. If an immediate update is not feasible, the plugin should be deactivated to prevent exploitation while a maintenance window is scheduled.