Description

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-29T12:16:41.163Z",
  "pubdate": "2026-08-29T12:16:41.163Z",
  "executiveSummary": "The Sigma Forms Pro plugin for WordPress, in versions up to and including 1.4.5, is susceptible to an unauthenticated Remote Code Execution (RCE) vulnerability. This critical flaw stems from improper input validation and insecure capability management within the plugin's submission handling mechanism.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the underlying web server by uploading malicious files through form fields. Because several pre-built form templates, such as 'Job Application' and 'Support Ticket', lack file type restrictions by default, the plugin is immediately exploitable upon installation without requiring elevated privileges or prior authentication.\nThe risk implication is severe, as successful exploitation results in full server compromise, potential data exfiltration, and unauthorized access to the WordPress environment. The vulnerability effectively bypasses standard security measures by dynamically elevating user permissions and failing to enforce mandatory MIME type validation, making it an ideal target for automated exploitation tools.",
  "technicalDetails": "The vulnerability originates in the handle_form_submission function, which fails to securely process user-supplied file uploads. The primary root cause is twofold: insecure capability assignment and deficient validation logic. During the execution of the submission process, the plugin dynamically grants the 'unfiltered_upload' capability to users. This programmatic elevation of privileges bypasses the standard WordPress hardening measures that typically prevent low-privileged or unauthenticated users from uploading executable content to the server.\nFurthermore, the plugin fails to enforce strict MIME type validation when the 'allowed_file_types' configuration parameter is omitted or left at default settings. In the context of the default pre-built templates provided with the plugin, these restrictions are absent by design. This lack of validation permits the transmission of arbitrary file types, including server-side scripts like PHP (.php), to the target directory.\nThe attack flow follows a predictable pattern: An unauthenticated attacker identifies a form instance created using a vulnerable pre-built template. The attacker crafts an HTTP POST request containing a malicious payload (typically a web shell) disguised as a file upload. Due to the lack of restrictive file extension checking or content-based MIME validation, the handle_form_submission function writes the file to the web server's document root or an accessible uploads directory. Once the file is persisted on the disk, the attacker accesses the file via a direct URL request. The server executes the uploaded script, granting the attacker the ability to interact with the system under the permissions context of the web server (e.g., www-data).\nPost-exploitation impact is catastrophic, as the attacker gains the ability to execute system commands, modify the WordPress database, pivot to other internal network resources, or maintain persistent access via backdoors. The combination of dynamic capability granting and the absence of file-type whitelisting ensures that even in default configurations, the attack surface remains wide open to remote exploitation."
}