CVE-2026-78657

SigmaForms Pro – AI Generated Forms, a WordPress forms plugin, contains an arbitrary file deletion flaw (CWE-22) caused by insufficient file path validation in its delete_submission_files function. An unauthenticated attacker submits a path-traversal value through a form upload field; the value is stored in the database, and the targeted file is deleted when an administrator deletes that submission record from the WordPress admin panel. By deleting arbitrary files on the server, an attacker can cause data loss and achieve remote code execution when a critical file such as wp-config.php is removed. Every WordPress site running SigmaForms Pro in any version up to and including 1.4.11 is affected. The flaw is rated critical (CVSS 3.1: 9.8), has no known public proof-of-concept, is not listed in CISA's KEV, and EPSS estimates only a 0.7% chance of exploitation within the next 30 days.

What to do: Update SigmaForms Pro to the first release after 1.4.11 as soon as a patched version is published, since all versions through 1.4.11 are affected and no fixed version is stated in the current data. Until patched, inspect stored form upload field values in the database for path-traversal strings (e.g., ../) and avoid deleting submission records until suspicious entries are removed, because deleting a submission is what triggers the file deletion. If compromise is suspected, verify the integrity of critical files such as wp-config.php.