What the vulnerability does
01Description
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
Explanation of Vulnerability in Simple Terms
02Summary
SigmaForms Pro versions up to 1.4.11 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, and other confidential data. No user interaction or authentication is required to exploit this flaw.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration files and credentials.
Potential impact on your site
04Site Impact
Attackers can access sensitive files like wp-config.php, database backups, and private keys without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 2, 2026
CVE published
