CVE-2026-78657: SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SigmaForms Pro (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.4.11 - Compensating control
Assume arbitrary file deletion may already have been exploited via the vulnerable form upload field; restrict administrative access to the WordPress admin panel (e.g., via firewall/ACL) so only trusted IPs can delete submission records.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An unauthenticated attacker must be able to submit a form containing a file upload field and provide a malicious path traversal value. The deletion is triggered only when an administrator later deletes the corresponding submission record from the WordPress admin panel.
Are sites exposed without administrator interaction?
The attacker can store the malicious path in the database without authentication, but file deletion requires an administrator to delete the affected submission. Sites using forms with file upload fields are the relevant exposure described.
What is the impact if exploitation succeeds?
An attacker can cause deletion of arbitrary server files. Deleting a file such as wp-config.php can lead to remote code execution.
How can administrators check for attempted exploitation?
Review submissions associated with forms that have file upload fields before deleting them, particularly for upload-path values containing path traversal sequences. The described attack stores the malicious path in the submission record.