CVE-2026-14494: bdthemes sigmaforms pro – ai generated forms

Vulnerability summary

CVE-2026-14494 is a critical (CVSS 9.8) vulnerability in bdthemes sigmaforms pro – ai generated forms. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities. Fixed in 1.4.6.

Timeline

1. 29-08-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.