A critical (CVSS 9.8) arbitrary file upload flaw in the SigmaForms Pro WordPress plugin reportedly lets unauthenticated attackers execute code on the server, and several of the plugin's default templates appear to be exploitable the moment they're installed.
What Is It
CVE-2026-14494 is a CWE-434 (unrestricted upload of file with dangerous type) vulnerability in the handle_form_submission function of the SigmaForms Pro plugin for WordPress. According to the Wordfence advisory, the plugin dynamically grants the unfiltered_upload capability to all users during form submissions, and skips MIME type validation when allowed_file_types is not configured. That combination is reported to allow an unauthenticated attacker to upload and execute arbitrary code on the server. The technical details have not been independently reproduced in the supplied data.
Why It Matters
The CVSS 3.1 base score is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
What may make this worse than a typical upload bug is the default configuration. Several pre-built templates shipped with the plugin, Job Application, Support Ticket, and Wholesale Application, are described in the advisory as including file upload fields with no file type restrictions configured. If that holds, a stock installation using one of those templates would be exploitable out of the box, with no misconfiguration required by the site owner. Administrators should verify the upload-field configuration on their own installations rather than assume any particular template is safe or unsafe.
The CISA Known Exploited Vulnerabilities catalog contains no entry for this CVE, so there is no confirmed active exploitation in KEV at this time.
What's Vulnerable
- Vendor: bdthemes
- Product: SigmaForms Pro – AI Generated Forms (WordPress plugin)
- Affected versions: all versions up to and including 1.4.5
- Highest-risk configurations: sites using the Job Application, Support Ticket, or Wholesale Application templates
Patch Status
The NVD record is in Received status (published 2026-08-29) and does not name a fixed version. No specific required action or remediation deadline is present in the supplied data. The vendor announcements page listed in the CVE references is the authoritative place to check for a patched release.
Sources
- NVD, CVE-2026-14494 (source: [email protected])
- Wordfence Threat Intelligence; https://www.wordfence.com/threat-intel/vulnerabilities/id/44d63454-87f0-49e3-ac04-2fa83882500d?source=cve
- bdthemes Announcements; https://feedback.bdthemes.com/announcements
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog