CVE-2026-14494: Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME type validation when allowedfiletypes is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sigma Forms Proto a version that resolves this vulnerability.Fixed in 1.4.5 - Configuration
Configure file upload type restrictions for the pre-built templates (Job Application, Support Ticket, Wholesale Application) so the file upload field has file type restrictions enabled; this addresses the condition where MIME type validation is bypassed when allowed_file_types is not configured.
Sigma Forms Pro (WordPress plugin) allowed_file_types = configured - Configuration
Ensure the plugin does not dynamically grant the unfiltered_upload capability to all users during form submissions; this prevents unauthenticated attackers from uploading executable files via handle_form_submission.
Sigma Forms Pro (WordPress plugin) unfiltered_upload capability during form submissions = not granted to all users - Compensating control
Block/limit unauthenticated access to the affected form submission endpoints for Sigma Forms Pro (e.g., via network/WAF/ACL) to reduce exposure until the plugin is remediated.