This vulnerability (CVE-2026-52705) affects BDthemes SigmaForms Pro – AI Generated Forms versions up to 1.4.5 and allows unauthenticated attackers to upload arbitrary files without restriction on file type. This unrestricted file upload can lead to severe consequences including complete system compromise, data breach, and denial of service. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction but requires high attack complexity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to full system compromise, data confidentiality loss, integrity violations, and service disruption. The CVSS score of 9.0 indicates critical impact across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable application, implement web application firewalls with file upload restrictions, and monitor for suspicious upload activity.