The vulnerability in Sigma Forms Pro allows an attacker to upload an arbitrary file without authentication because the plugin grants the unfiltered_upload capability to all users during form submissions and skips MIME type validation when allowed_file_types is not set. This defect results in the server executing the uploaded file, giving the attacker full code execution rights.|The flaw is present in all versions up to 1.4.5 and is active by default in several pre‑built templates that include file‑upload fields. Attackers can simply submit a crafted file through any of these forms and trigger the upload.|The plugin’s design makes the attack trivial once the site is exposed; no user interaction beyond form submission is required, and no privileged account is needed.|

All installations of the WordPress plugin “Sigma Forms Pro – AI Generated Forms” that are at or below version 1.4.5 are affected. The issue is triggered by any enabled form that contains a file‑upload field and has no configured allowed_file_types restriction. Users of the default pre‑built templates such as Job Application, Support Ticket, or Wholesale Application are exposed immediately upon installation.

The CVSS score of 9.8 indicates very high severity. No EPSS data is available, so the likelihood of exploitation is unclear but the ease of exploitation is extreme. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it unauthenticated by submitting a malicious file via the form upload field; the plugin’s unfiltered_upload capability causes the server to accept the file and the missing MIME check allows it to be executed. The lack of any additional prerequisites or complex configuration steps gives the attacker a straight path to remote code execution.