Security Alert Summary
The SigmaForms Pro – AI Generated Forms plugin for WordPress contains an arbitrary file deletion vulnerability that affects all versions up to and including 1.4.11. An attacker can submit a path traversal payload via a form upload field, which is stored in the database and later used by the plugin’s deletion routine when an administrator deletes the associated submission. This can allow deletion of arbitrary files on the server and may lead to further impact such as remote code execution if critical files are removed.
CVE Details
- CVE ID:
CVE-2026-78657 - Affected component: SigmaForms Pro – AI Generated Forms plugin (bdthemes)
- Affected versions: All versions up to and including 1.4.11
- Published: September 2, 2026 at 6:17:18 AM UTC
- Last modified: September 2, 2026 at 1:55:27 PM UTC
- CVSS v3.1: Base Score 9.8 – CRITICAL; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE / weakness ID: CWE-22 (Path Traversal)
Technical Details
The vulnerability is caused by insufficient file path validation in the plugin’s delete_submission_files function. A malicious path traversal payload submitted through a form upload field is stored in the database. When an administrator deletes the submission record from the WordPress admin panel, the plugin calls the deletion routine and uses the stored path value without adequate sanitization or restriction, allowing deletion of arbitrary files on the server.
The deletion of arbitrary files can directly impact availability and integrity of the site and, in cases where sensitive files are removed (for example configuration files), can enable further attacks such as remote code execution. The description identifies the specific vulnerable function (delete_submission_files) and the mechanism: stored malicious path data deleted when an administrator removes the related submission.
How This Could Impact Your Website
Consider a typical small company site with a site owner, several internal staff users (editors or administrators), and an external contractor who manages forms. An unauthenticated attacker could submit a specially crafted upload path through a public form. That path is stored and later acted on when an administrator or staff member deletes the submission from the admin interface. The result could be deletion of important files, causing service outages or corrupted site content. If configuration files or other sensitive files are removed, the attacker may be able to extend the attack to obtain code execution or expose sensitive information indirectly. This increases risk for targeted phishing or social engineering against staff whose accounts remain active.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributor-level users and any nonessential administrators.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, especially file deletions or unexpected admin actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
