The SigmaForms Pro plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated attackers to compromise the underlying server.

This flaw stems from an unrestricted file upload mechanism (CWE-434) that bypasses MIME type validation and incorrectly assigns the unfiltered_upload capability to users, enabling unauthenticated remote code execution.

Successful exploitation allows an attacker to execute arbitrary code on the web server with the privileges of the web application. This poses a catastrophic risk, including complete system takeover, unauthorized access to sensitive database information, and potential lateral movement within the network. Given the CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent total environment compromise.

Immediate Action: Update the SigmaForms Pro plugin to the latest available version provided by bdthemes. If an update is not immediately available, deactivate and remove the plugin from the WordPress environment until a patch is applied.

Proactive Monitoring: Review web server access logs for suspicious file upload requests, particularly those targeting the handle_form_submission endpoint or files with unexpected extensions in the upload directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict access to plugin-specific endpoints to known-good IP addresses.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this remote code execution vulnerability and the lack of default security restrictions in the plugin, immediate action is required. Organizations using SigmaForms Pro should prioritize updating to the latest version or disabling the plugin until a secure version is confirmed to mitigate the risk of full system compromise.