EUVD-2026-68094
GHSA-vgff-mr3q-h6mh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable file upload leads to server code execution with no user interaction, and default templates are exploitable, so PR:N, UI:N, AC:L and full C/I/A:H all hold.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a form built with Sigma Forms Pro that contains a file-upload field whose allowed_file_types option is not configured - a state that exists by default in the shipped Job Application, Support Ticket, and Wholesale Application templates, making default installs immediately exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version was identified in the available data, so a fixed version cannot be cited; monitor the bdthemes announcements page (https://feedback.bdthemes.com/announcements) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/44d63454-87f0-49e3-ac04-2fa83882500d?source=cve) for a release above 1.4.5 and upgrade immediately once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress instances for Sigma Forms Pro plugin and immediately deactivate and remove all plugin files; preserve server logs for forensic analysis of the plugin directory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today