By chaining this vulnerability with the deletion of critical WordPress configuration files such as wp-config.php, an attacker can force a re-installation of the application, potentially leading to remote code execution. Because the malicious trigger occurs during an administrative action, there is a delayed execution window between the initial malicious submission and the final file deletion.

Attack Chain

1. Attacker identifies a WordPress site running SigmaForms Pro version 1.4.11 or lower.
2. Attacker submits a form containing an upload field.
3. Attacker inputs a path traversal string (e.g., ../../../wp-config.php) into the upload field payload.
4. The malicious string is stored in the database as a submission record by the plugin.
5. An administrator logs into the WordPress dashboard.
6. The administrator selects the malicious submission record and triggers a delete action.
7. The plugin executes delete_submission_files, invoking the file deletion logic with the attacker-supplied path.
8. The targeted file is deleted from the server filesystem.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the WordPress server. This can cause significant service disruption or lead to full system compromise if attackers delete critical files like wp-config.php to initiate a site re-installation. The vulnerability affects all users running versions 1.4.11 or earlier of the SigmaForms Pro plugin.

Recommendation

Prioritized actions for security teams:

• Update SigmaForms Pro - AI Generated Forms to the latest version (v1.4.12 or higher) to remediate CVE-2026-78657.
• Audit web server access logs for anomalous POST requests to form submission endpoints containing directory traversal patterns like '../'.
• Restrict file system permissions for the WordPress application user to prevent deletion of sensitive files outside of the intended upload directories.