CVE-2026-22460: Arbitrary File Access in wpWax FormGent

The Arbitrary File Access vulnerability in FormGent allows an attacker to bypass intended access controls and read files outside of the plugin's designated directory. This could expose sensitive configuration files, database credentials, or even source code. Successful exploitation could lead to complete compromise of the WordPress instance. The attacker could potentially gain access to user data, modify website content, or execute arbitrary code if the exposed files contain sensitive information or scripts. This vulnerability shares characteristics with other path traversal exploits, where attackers leverage directory traversal sequences (e.g., '../') to navigate the file system.

1. Reserved2026-01-07
2. Published2026-03-05
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22460 is to upgrade to a patched version of FormGent as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. These may include restricting file access permissions on the server, using a Web Application Firewall (WAF) to filter out malicious requests containing path traversal sequences, and carefully reviewing the plugin's code for potential vulnerabilities. Monitor access logs for suspicious file access attempts. After upgrading, verify the fix by attempting to access files outside the intended directory via the plugin's interface; access should be denied.

Active installs

1KKnown

Plugin rating