CVE-2026-14494
Received Received - Intake

Remote Code Execution in Sigma Forms Pro WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: Wordfence

Description
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-14494
EUVD
EUVD-2026-68094

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sigma_forms_pro sigma_forms_pro to 1.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Sigma Forms Pro WordPress plugin up to version 1.4.5 allows remote code execution due to improper handling of file uploads. The plugin grants dangerous file upload permissions to all users during form submissions and skips MIME type checks when file type restrictions are not set. Unauthenticated attackers can exploit this to run malicious code on the server.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in uploads folders. Look for unexpected PHP or executable files. Review user roles for unfiltered_upload capability granted to non-admin users. Inspect network traffic for unusual POST requests to /wp-admin/admin-post.php with file upload parameters.

Impact Analysis

This vulnerability allows attackers to upload and execute arbitrary code on your server without authentication. If exploited, attackers could take full control of your WordPress site, steal data, install malware, or use your server for further attacks. Sites using default templates with file upload fields are at immediate risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in exposure of sensitive user data, triggering compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the Sigma Forms Pro plugin to the latest version if available. Disable file upload functionality in the plugin settings. Remove the unfiltered_upload capability from non-admin users via WordPress user role management. Implement strict file upload restrictions and MIME type validation at the server level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart