CVE-2026-14494 bdthemes CVE debrief

Who should care

WordPress administrators and users of the Sigma Forms Pro plugin, especially those with unfiltered_upload capability granted to users or using default pre-built templates with file upload fields.

Technical summary

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

Defensive priority

Immediate attention required due to critical CVSS score of 9.8 and potential for unauthenticated code execution.

Recommended defensive actions

• Update Sigma Forms Pro plugin to a version beyond 1.4.5
• Review and restrict file upload fields in custom templates
• Implement additional security measures to monitor and restrict user uploads
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5. The vulnerability exists due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. Several default pre-built templates have file upload fields with no file type restrictions, making this vulnerability immediately exploitable upon installation. Evidence is based on CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.