What is the CVSS score of CVE-2026-52705?

CVE-2026-52705 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SigmaForms Pro are affected by CVE-2026-52705?

SigmaForms Pro WordPress plugin (versions ≤1.4.5) contains a critical unauthenticated arbitrary file upload vulnerability (CVSS 9.0) enabling webshell deployment and complete website takeover-no…

How to fix or mitigate CVE-2026-52705?

24 hours: Identify all WordPress instances running SigmaForms Pro ≤1.4.5; immediately deactivate and remove the plugin; conduct forensic audit of wp-content/uploads/ for suspicious files (PHP, executables) and review server logs for unauthorized upload activity. 7 days: Migrate to alternative form solution with current security maintenance; if immediate replacement is infeasible, deploy web application firewall (WAF) rules restricting file uploads to whitelisted extensions only and configure web server to block script execution in wp-content/uploads/. 30 days: Complete form plugin replacement to eliminate vulnerability; establish continuous vulnerability scanning of remaining WordPress plugins; document remediation completion for compliance records.

SigmaForms Pro CVE-2026-52705

EUVD-2026-37627 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-17 Patchstack

WordPress File Upload Wordpress Plugin Sigmaforms Pro Ai Generated Forms Bdthemes

9.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable unauthenticated upload endpoint (AV:N/PR:N/UI:N); AC:H reflects a non-trivial validation bypass; successful upload yields PHP execution affecting the underlying host beyond the plugin (S:C, C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:00 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary File Upload in SigmaForms Pro - AI Generated Forms <= 1.4.5 versions.

AnalysisAI

Unauthenticated arbitrary file upload in the SigmaForms Pro - AI Generated Forms WordPress plugin (versions <= 1.4.5) allows remote attackers to upload files of their choosing to the underlying web server, enabling webshell deployment and full site takeover. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 9.0 with scope change, indicating impact beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

SigmaForms Pro - AI Generated Forms is a commercial WordPress form-builder plugin developed by BdThemes (CPE: cpe:2.3:a:bdthemes:sigmaforms_pro_-_ai_generated_forms). The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the plugin exposes an upload handler that fails to properly validate file extension, MIME type, or contents before writing the uploaded file into a web-accessible location. In WordPress plugin contexts, such handlers are typically reachable through admin-ajax.php, REST API endpoints, or custom form-submission routes, and a lack of capability checks together with weak validation lets attackers drop PHP files into wp-content directories that the web server will execute.

RemediationAI

Upgrade SigmaForms Pro - AI Generated Forms to a version newer than 1.4.5 once the vendor publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sigmaforms-pro/vulnerability/wordpress-sigmaforms-pro-ai-generated-forms-plugin-1-4-5-arbitrary-file-upload-vulnerability for the confirmed patched version, as the exact fix version was not included in the supplied data. If immediate patching is not possible, deactivate and remove the SigmaForms Pro plugin entirely (forms rendered by it will stop working), or place a WAF rule (e.g., Patchstack mU, Wordfence, or ModSecurity) in front of WordPress that blocks POST requests to the plugin's upload endpoint and rejects multipart uploads containing .php, .phtml, .phar, or double-extension filenames. As an additional containment measure, deny PHP execution inside wp-content/uploads via web-server configuration (Apache .htaccess or Nginx location block), accepting the trade-off that any legitimate plugin relying on executing PHP from uploads will break.