Sigma Forms Pro WordPress Plugin Unauthenticated RCE via Arbitrary File Upload

Technical Analysis

CVE-2026-14494 (CVSS 9.8) stems from the handle_form_submission function dynamically granting the unfiltered_upload capability to all users, including unauthenticated visitors, during form submission processing. When the allowed_file_types configuration is empty, MIME type validation is bypassed entirely, permitting upload of executable PHP or other server-side scripts to the webroot. Default pre-built templates such as Job Application, Support Ticket, and Wholesale Application include file upload fields with no type restrictions configured out of the box, meaning any WordPress site using these templates is exploitable immediately post-installation without administrator misconfiguration. Successful exploitation grants attackers arbitrary code execution in the context of the web server, enabling web shell deployment, lateral movement, credential harvesting, and full site/server compromise. Organizations running AI agents or RAG pipelines that use WordPress-hosted content sources, CMS-integrated knowledge bases, or shared hosting environments alongside vulnerable WordPress instances face risk of credential or API key theft and lateral compromise of agent infrastructure if this plugin is present on co-located or connected systems.

Affected Systems

WordPress installations running Sigma Forms Pro plugin versions up to and including 1.4.5, particularly sites using default templates: Job Application, Support Ticket, and Wholesale Application forms with unconfigured allowed_file_types settings

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous file uploads to wp-content/uploads directories with executable extensions (.php, .phtml, .php5), unexpected POST requests to admin-ajax.php with action=handle_form_submission, and newly created web shell files in plugin-related upload paths

Remediation Steps

1. 1

   Update Plugin Immediately

   Update Sigma Forms Pro to the latest patched version beyond 1.4.5 as soon as it is released by the vendor.

2. 2

   Disable Vulnerable Forms

   Temporarily disable or remove Job Application, Support Ticket, and Wholesale Application form templates until patched, or manually configure allowed_file_types restrictions on all forms.

3. 3

   Web Application Firewall Rules

   Deploy WAF rules to block file uploads with executable extensions (.php, .phtml, .phar, .exe) through form submission endpoints.

4. 4

   Audit Upload Directories

   Scan wp-content/uploads and plugin-specific directories for unauthorized executable files or web shells.

5. 5

   Restrict File Execution in Uploads

   Configure the web server to prevent PHP execution within upload directories via .htaccess or nginx configuration directives.

6. 6

   Monitor and Log

   Enable enhanced logging on form submission endpoints and review for anomalous unauthenticated POST requests targeting handle_form_submission.