Arbitrary File Deletion Vulnerability in SigmaForms Pro

The SigmaForms Pro - AI Generated Forms plugin for WordPress, in versions up to and including 1.4.11, is susceptible to an unauthenticated arbitrary file deletion vulnerability. This flaw resides in the delete_submission_files function, which fails to properly validate file paths during the deletion process. An attacker can inject a path traversal sequence into an upload field of a form. This malicious path is saved into the database within a submission record. When a site administrator later performs a cleanup or removes the submission record from the WordPress admin panel, the plugin processes the path and deletes the targeted file.

By chaining this vulnerability with the deletion of critical WordPress configuration files such as wp-config.php, an attacker can force a re-installation of the application, potentially leading to remote code execution. Because the malicious trigger occurs during an administrative action, there is a delayed execution window between the initial malicious submission and the final file deletion.

Attack Chain

1. Attacker identifies a WordPress site running SigmaForms Pro version 1.4.11 or lower.
2. Attacker submits a form containing an upload field.
3. Attacker inputs a path traversal string (e.g., ../../../wp-config.php) into the upload field payload.
4. The malicious string is stored in the database as a submission record by the plugin.
5. An administrator logs into the WordPress dashboard.
6. The administrator selects the malicious submission record and triggers a delete action.
7. The plugin executes delete_submission_files, invoking the file deletion logic with the attacker-supplied path.
8. The targeted file is deleted from the server filesystem.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the WordPress server. This can cause significant service disruption or lead to full system compromise if attackers delete critical files like wp-config.php to initiate a site re-installation. The vulnerability affects all users running versions 1.4.11 or earlier of the SigmaForms Pro plugin.

Recommendation

Prioritized actions for security teams:

• Update SigmaForms Pro - AI Generated Forms to the latest version (v1.4.12 or higher) to remediate CVE-2026-78657.
• Audit web server access logs for anomalous POST requests to form submission endpoints containing directory traversal patterns like '../'.
• Restrict file system permissions for the WordPress application user to prevent deletion of sensitive files outside of the intended upload directories.