CVE-2026-94499
HighCVSS 7.1Summary
The FormGent plugin in versions up to and including 1.12.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. Missing access control checks allow unauthorized operations to be performed.
Risk Assessment
A low-privileged attacker (Subscriber) can bypass access control mechanisms and perform actions reserved for authorized users.
Recommendation
Update the FormGent plugin to a version newer than 1.12.2.
Other vulnerabilities in FormGent
See all- CVE-2026-3141Critical
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on a REST API endpoint. Unauthenticated attackers can delete arbitrary files in the formgent uploads directory, and on Linux servers, if the directory does not exist, they can bypass path traversal protection and delete files like wp-config.php.
- CVE-2025-15028High
The FormGent – Next-Gen AI Form Builder for WordPress plugin is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS