CVE-2026-78657

Name of the Vulnerable Software and Affected Versions SigmaForms Pro – AI Generated Forms versions prior to 1.4.12

Description Insufficient file path validation in the delete submission files() function allows unauthenticated attackers to delete arbitrary files on the server. This is achieved by submitting a malicious path traversal URL via a form upload field, which is then stored in the database. The deletion is triggered when an administrator removes the submission record from the admin panel. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update SigmaForms Pro – AI Generated Forms to version 1.4.12 or later. As a temporary mitigation, restrict the use of the delete submission files() function until the update is applied.