CVE-2026-14494

Name of the Vulnerable Software and Affected Versions Sigma Forms Pro versions prior to 1.4.6

Description Remote Code Execution is possible via the handle form submission() function. The issue occurs because the plugin dynamically grants the unfiltered upload capability to all users during form submissions and bypasses MIME type validation when the allowed file types variable is not configured. This allows unauthenticated attackers to execute code on the server. Certain pre-built templates, such as Job Application, Support Ticket, and Wholesale Application, include file upload fields without file type restrictions by design, making the issue exploitable immediately after installation.

Recommendations Update Sigma Forms Pro to version 1.4.6 or later. As a temporary mitigation, restrict access to or disable the use of pre-built templates containing file upload fields, such as Job Application, Support Ticket, and Wholesale Application, until the update is applied.