A critical vulnerability in the SigmaForms Pro plugin allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to full remote code execution.

The plugin contains a path traversal vulnerability in the delete_submission_files function that allows an unauthenticated attacker to supply a malicious file path via a form upload. This path is stored in the database and processed when an administrator deletes a submission, resulting in the unauthorized deletion of arbitrary server files.

The ability for an unauthenticated attacker to delete critical system files, such as wp-config.php, poses an extreme risk to business continuity and data integrity. Given the CVSS score of 9.8, this flaw is categorized as critical because it provides a direct pathway for attackers to compromise the entire web application and achieve remote code execution.

Immediate Action: Update the SigmaForms Pro – AI Generated Forms plugin to version 1.4.12 or higher immediately to resolve the path validation flaw.

Proactive Monitoring: Review server logs for suspicious form submission activity and monitor for unexpected file deletion events within the web directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal sequences, such as directory dots and slashes, to provide temporary protection until the update is applied.

Public Exploit Available: Unknown

This vulnerability is highly critical and requires immediate attention to prevent potential full-system compromise. Administrators must prioritize updating the SigmaForms Pro plugin to version 1.4.12, as the risk of remote code execution through file deletion is significant and directly impacts the security posture of the WordPress environment.