Description

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-02T06:17:18.260Z",
  "pubdate": "2026-09-02T06:17:18.260Z",
  "executiveSummary": "The SigmaForms Pro – AI Generated Forms plugin for WordPress, in versions up to and including 1.4.11, contains a critical arbitrary file deletion vulnerability.\nThis security flaw stems from improper sanitization and validation of file paths within the delete_submission_files function.\nUnauthenticated attackers can inject malicious path traversal sequences into form upload fields, which are subsequently stored in the WordPress database.\nThe vulnerability is triggered when an administrator performs a deletion operation on a submission record from the WordPress administrative dashboard.\nSuccessful exploitation allows an attacker to delete arbitrary files from the underlying server filesystem.\nThe impact of this vulnerability is severe, as the deletion of critical system files, such as wp-config.php, can force a site reset, cause service disruption, or facilitate remote code execution by bypassing security configurations or allowing an attacker to overwrite sensitive files after deletion.",
  "technicalDetails": "The vulnerability resides within the delete_submission_files function of the SigmaForms Pro plugin. The root cause is the lack of strict input validation and insufficient path sanitization when processing file paths submitted via form upload fields.\nThe attack flow begins when an attacker submits a crafted form containing a file path traversal payload. Because the plugin does not validate the integrity or the location of the file path provided, the malicious string is accepted and stored directly into the database as part of the submission metadata.\nThe vulnerability remains dormant until a WordPress administrator accesses the admin panel and initiates the deletion of the submission record. At this point, the delete_submission_files function retrieves the stored, malicious path string and executes a file deletion command using the unsanitized input.\nBecause the function fails to restrict file system access to a specific, sandboxed directory, the application interprets the traversal sequences (e.g., ../../) as legitimate filesystem instructions. This allows the application to escape the intended storage directory and target sensitive files in the WordPress root directory or higher, including configuration files like wp-config.php or critical plugin and theme files.\nWhile the trigger requires an administrative action, the initial payload injection is unauthenticated. This decoupling of the injection and the execution phases means that an attacker does not require elevated privileges to prepare the exploit; they rely on standard administrative workflows to finalize the malicious operation.\nThe technical impact is significant. Deleting wp-config.php, for instance, terminates the database connection, effectively taking the site offline. Furthermore, by deleting key site files, an attacker can leave the site in an unstable state, potentially allowing for the reinstallation of WordPress or the injection of malicious code into files that were intended to be protected by the server's filesystem permissions, ultimately leading to full remote code execution.\nAffected versions include all releases of SigmaForms Pro up to and including 1.4.11."
}