This vulnerability (CVE-2026-52705) affects BDthemes SigmaForms Pro – AI Generated Forms versions <= 1.4.5. It permits unauthenticated arbitrary file upload, which can be exploited to upload malicious files. The CVSS 3.1 base score is 9.0, indicating critical severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-434, indicating a failure to restrict file upload types properly. No patch or official remediation level has been published yet.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to full system compromise including data theft, data manipulation, or denial of service. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application, monitor for suspicious file uploads, and consider implementing web application firewall (WAF) rules to block malicious upload attempts.