EXPOSURES › CVE-2026-14494
CVE-2026-14494
CRITICALCVE-2026-14494 allows unauthenticated remote code execution in the Sigma Forms Pro WordPress plugin via unfiltered file uploads in default templates.
The Sigma Forms Pro WordPress plugin grants unfiltered upload capabilities to all users during form submissions and bypasses MIME type validation when allowed_file_types is not configured. Default templates like Job Application and Support Ticket have no file type restrictions by design, enabling immediate exploitation upon installation. DIB organizations must ensure WordPress plugins are rigorously vetted, as unpatched RCE vulnerabilities in widely used software can lead to full system compromise and violate CMMC/NIST 800-171 requirements for software supply chain security.
Shame score — The vulnerability is immediately exploitable upon installation due to default templates with no file type restrictions, indicating a design flaw rather than a simple oversight.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.