Sigma Forms Pro CVE-2026-14494

Exploitation requires a form built with Sigma Forms Pro that contains a file-upload field whose allowed_file_types option is not configured - a state that exists by default in the shipped Job Application, Support Ticket, and Wholesale Application templates, making default installs immediately exploitable. The attack path is the handle_form_submission function, which grants unfiltered_upload to the submitter and bypasses MIME validation. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions beyond network reachability: no authentication and no user interaction are needed. The main limiting factor is configuration - if an operator has set a restrictive allowed_file_types allow-list on every upload field, the MIME bypass does not apply and exploitation is blocked.

This is a genuine top-priority issue rather than an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) aligns fully with the described attack: network-reachable, no authentication, no user interaction, and full server compromise. The decisive amplifier is that several default templates ship with unrestricted upload fields, so the bug is exploitable on a fresh install with no operator misconfiguration required, which typically drives EPSS upward once weaponized. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so automatability and exploitation-status signals cannot be quantitatively confirmed here; however, the combination of unauthenticated RCE and default-exploitable configuration means even a small operator or municipal IT team should treat patching as urgent. No public exploit code was supplied, so this remains a pre-weaponization window that defenders should use to remediate ahead of mass scanning.

An attacker locates a WordPress site running Sigma Forms Pro that exposes a Job Application or Support Ticket form, then submits the form with a malicious PHP file attached to the unrestricted upload field. Because the plugin grants unfiltered_upload and skips MIME validation, the file lands in a web-accessible directory; the attacker then requests its URL to execute the payload and gain code execution as the web server user. No authentication, user interaction, or public exploit tooling is required given the default-exploitable templates.