Sigmaforms Pro Ai Generated Forms
Monthly
Arbitrary file deletion in the SigmaForms Pro - AI Generated Forms plugin for WordPress (all versions through 1.4.11) lets unauthenticated attackers submit a path-traversal string through a form's file-upload field, which is stored in the database and processed by the vulnerable delete_submission_files function. When an administrator later deletes the submission record, the plugin removes the attacker-specified file - deleting wp-config.php (or similar) can escalate to full site takeover/remote code execution. Reported by Wordfence; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated arbitrary file upload in the SigmaForms Pro - AI Generated Forms WordPress plugin (versions <= 1.4.5) allows remote attackers to upload files of their choosing to the underlying web server, enabling webshell deployment and full site takeover. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 9.0 with scope change, indicating impact beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Arbitrary file deletion in the SigmaForms Pro - AI Generated Forms plugin for WordPress (all versions through 1.4.11) lets unauthenticated attackers submit a path-traversal string through a form's file-upload field, which is stored in the database and processed by the vulnerable delete_submission_files function. When an administrator later deletes the submission record, the plugin removes the attacker-specified file - deleting wp-config.php (or similar) can escalate to full site takeover/remote code execution. Reported by Wordfence; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated arbitrary file upload in the SigmaForms Pro - AI Generated Forms WordPress plugin (versions <= 1.4.5) allows remote attackers to upload files of their choosing to the underlying web server, enabling webshell deployment and full site takeover. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 9.0 with scope change, indicating impact beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.