CVE-2026-14494: CWE-434 Unrestricted Upload of File with Dangerous Type in bdthemes SigmaForms Pro – AI Generated Forms

CVE-2026-14494 is a critical remote code execution vulnerability in the Sigma Forms Pro WordPress plugin (up to and including version 1.4.5). The vulnerability arises because the plugin dynamically grants the unfiltered_upload capability to all users during form submissions and does not enforce MIME type validation when the allowed_file_types setting is not configured. This allows unauthenticated attackers to upload files of dangerous types and execute arbitrary code on the server. Default pre-built templates such as Job Application, Support Ticket, and Wholesale Application include file upload fields with no file type restrictions by design, enabling immediate exploitation upon installation.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected server, leading to full compromise including confidentiality, integrity, and availability impacts. The vulnerability affects all users of the plugin who have not configured allowed_file_types, and the presence of default templates without file type restrictions increases the risk of immediate exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should configure the allowed_file_types setting to restrict file uploads to safe types or disable file upload fields in default templates. Monitoring vendor communications for an official patch or update is strongly recommended.