The SigmaForms Pro WordPress plugin contains a path traversal flaw in its delete_submission_files function that can be exploited to delete any file on the server. Because the malicious path is stored in the database and later processed when an administrator removes a submission, an attacker who can submit a specially crafted upload field can delete files such as wp‑config.php, leading directly to remote code execution.

The vulnerability affects the SigmaForms Pro – AI Generated Forms plugin for WordPress, versions 1.4.11 and earlier. Any WordPress installation with those versions deployed remains vulnerable until the plugin is upgraded beyond 1.4.11.

The CVSS score of 9.8 shows critical severity, and the flaw can be exploited without any authentication, making it easily usable by external actors. While no EPSS data is available and the issue is not listed in CISA’s KEV catalog, the ability to delete a core configuration file means an attacker could achieve full control of the server with minimal effort. The path traversal attack vector requires that the attacker inject a crafted path into the database, which is then used unverified to delete the target file.