The FormGent plugin for WordPress (versions up to and including 1.9.2) contains a critical vulnerability allowing unauthenticated arbitrary file deletion via the /wp-json/formgent/responses/attachments REST API endpoint. The flaw stems from a missing capability check and lack of authentication middleware in the REST API route registration. Attackers can delete files within the formgent uploads directory without any credentials. On Linux servers where the wp-content/uploads/formgent directory does not yet exist, path traversal protections can be bypassed entirely. This bypass enables deletion of critical files such as wp-config.php, potentially leading to complete site takeover by triggering a fresh WordPress installation. The vulnerability is especially dangerous for newly installed instances of the plugin. A patch was introduced in version 1.10.0.