CVE-2026-14494

The Sigma Forms Pro plugin for WordPress, in all versions up to and including 1.4.5, is vulnerable to unauthenticated remote code execution (CWE-434) through its handle_form_submission function. During form submissions the plugin dynamically grants the unfiltered_upload capability to all users and, when the allowed_file_types setting is not configured, bypasses MIME type validation, allowing an unauthenticated attacker to upload arbitrary files such as PHP scripts that the web server then executes. Successful exploitation gives the attacker code execution on the server, consistent with the 9.8 CVSS score reflecting high confidentiality, integrity, and availability impact. Every site with the plugin active is affected, including fresh installations, because several default pre-built templates (Job Application, Support Ticket, Wholesale Application) ship with unrestricted file upload fields by design. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.7% probability of exploitation within the next 30 days.

What to do: Update Sigma Forms Pro to the latest available patched release (any version beyond 1.4.5) as soon as one is published, prioritizing sites that use the Job Application, Support Ticket, or Wholesale Application templates. As interim mitigations, configure allowed_file_types on every upload field so MIME validation is enforced, or deactivate the plugin until patched, and check the uploads directory and web server logs for unexpected PHP files or suspicious unauthenticated POST requests to form submission endpoints.