Loading vulnerability…
CVE-2026-3141 is an unauthorized arbitrary file deletion vulnerability in the FormGent plugin for WordPress affecting all versions up to and including 1.9.2. The flaw stems from a missing capability check on a REST API endpoint used for attachment handling, with the route registered without authentication middleware. As a result, unauthenticated remote attackers can invoke the endpoint to delete files without authorization. Under normal conditions, exploitation allows deletion of arbitrary files within the plugin’s upload area. On Linux systems, when the plugin-specific uploads directory does not yet exist, the intended path traversal protection can be bypassed, allowing deletion of files outside that directory, including critical WordPress configuration files. Removal of the main WordPress configuration file can place the site into a reinstallation state, creating a path to full compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Python exploit framework centered on WordPress targeting. It contains one substantive code file, wp2exp_2026.py, plus a README, license, and gitignore. The script is presented as an all-in-one tool that combines reconnaissance, vulnerability detection, exploitation, and post-exploitation actions against WordPress core and several plugins. Repository structure is minimal: README.md documents usage and claimed capabilities; wp2exp_2026.py is the operational entry point; there are no external modules besides Python standard library and optional SOCKS proxy support. The script supports single-target and multi-target execution, JSON reporting, threaded scanning, proxying, and multiple modes (scan, exploit, shell). Core capabilities described and partially evidenced in code/constants include: WordPress version fingerprinting; WAF detection from headers/body markers; XML-RPC probing; user enumeration through REST and author archives; plugin version enumeration; safe probing of the WordPress batch REST endpoint; CVE-specific checks for WordPress core and multiple plugins; exploitation chains for pre-auth admin creation; SQLi-based information extraction; content disclosure/dumping; and optional webshell deployment/verification. The code includes constants for vulnerable WordPress core ranges, plugin CVE metadata, SQLi/XPATH extraction regexes, union-based injection parameters, and a main workflow that runs scan_target() followed by exploit_chain() when exploit or shell mode is selected. Fingerprintable endpoints are primarily WordPress web paths and REST routes: /feed/, /readme.html, /wp-json/wp/v2/users, ?rest_route=, ?author=N, and /wp-json/batch/v1. The README also references POST /wp/v2/users as part of an admin-creation chain and system.listMethods for XML-RPC probing. A plugin namespace constant mcp/v1 appears in code for AI Engine targeting. The tool also supports a local SOCKS5/TOR proxy at socks5h://127.0.0.1:9050. Overall, this is not merely a detector script. It is an exploit-oriented framework with scanning and exploitation stages, optional shell deployment, and machine-readable reporting. Given the breadth of supported targets, chaining logic, and shell mode, its maturity is best characterized as weaponized.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.