CVE-2026-78657: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in bdthemes SigmaForms Pro – AI Generated Forms

CVE-2026-78657 is a path traversal vulnerability in the SigmaForms Pro – AI Generated Forms WordPress plugin. The vulnerability arises from insufficient validation of file paths in the delete_submission_files function. An attacker can submit a specially crafted path through a form upload field, which is stored in the database. When an administrator deletes the corresponding submission record, the plugin deletes files based on the stored path without proper sanitization, enabling arbitrary file deletion on the server. This can escalate to remote code execution by deleting critical files such as wp-config.php. The vulnerability affects all versions up to and including 1.4.11. There is no vendor advisory or patch information currently available.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can lead to denial of service or remote code execution if critical files are deleted. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid deleting submission records or restrict access to the admin panel to trusted users only. Monitoring for suspicious file deletions and restricting file system permissions may reduce risk but do not fully mitigate the vulnerability.