CVE-2026-78657 Overview
CVE-2026-78657 is an arbitrary file deletion vulnerability in the SigmaForms Pro – AI Generated Forms plugin for WordPress. The flaw exists in the delete_submission_files function through version 1.4.11 and stems from insufficient file path validation [CWE-22]. Unauthenticated attackers submit a path traversal payload through a form upload field, which the plugin stores in the database. When an administrator later deletes the submission record, the plugin removes the attacker-specified file from disk. Deleting critical files such as wp-config.php can trigger the WordPress setup flow and enable remote code execution.
Critical Impact
Unauthenticated attackers can delete arbitrary files on affected WordPress servers, leading to full site compromise through remote code execution when wp-config.php is deleted.
Affected Products
- SigmaForms Pro – AI Generated Forms plugin for WordPress
- All versions up to and including 1.4.11
- WordPress sites using BDThemes SigmaForms Pro
Discovery Timeline
- 2026-09-02 - CVE-2026-78657 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78657
Vulnerability Analysis
The vulnerability resides in the delete_submission_files function of SigmaForms Pro. The function accepts a file path stored in the submission record and calls file deletion routines without validating that the path stays within the intended uploads directory. Because form submissions are open to unauthenticated visitors, any attacker can seed the database with a crafted path.
The deletion itself executes with the privileges of the WordPress PHP process. That process typically has write access to the entire WordPress installation directory, including core configuration files. An attacker can chain the primitive with WordPress reinstallation behavior to achieve remote code execution.
Root Cause
The root cause is missing path canonicalization and directory containment checks. The delete_submission_files function trusts the file path supplied through the upload field and persisted in the submissions table. There is no validation that the resolved path resides inside the plugin's designated upload directory, and no authentication or capability check gates the initial submission.
Attack Vector
The attack proceeds in two stages. First, an unauthenticated attacker submits a form containing a path traversal sequence such as ../../../../wp-config.php in the upload field, which the plugin persists to the database. Second, when an administrator deletes the malicious submission from the WordPress admin panel, the plugin invokes delete_submission_files on the stored path. This removes wp-config.php from disk. With the configuration file absent, subsequent visitors reach the WordPress installation wizard, which an attacker can complete to point WordPress at an attacker-controlled database and execute PHP through theme or plugin uploads.
See the Wordfence Vulnerability ID C714E2B3 advisory for additional technical detail.
Detection Methods for CVE-2026-78657
Indicators of Compromise
- Form submission records containing path traversal sequences (../, ..\, encoded variants) in upload field values.
- Missing or recently modified wp-config.php files on WordPress hosts running SigmaForms Pro.
- Unexpected appearance of the WordPress /wp-admin/setup-config.php installation wizard on a previously configured site.
- SigmaForms Pro plugin versions at or below 1.4.11 installed on production WordPress instances.
Detection Strategies
- Query the SigmaForms submissions table for upload field values containing traversal patterns or absolute paths outside the plugin uploads directory.
- Monitor filesystem integrity for deletions of wp-config.php, .htaccess, and files under wp-content/plugins/ and wp-content/themes/.
- Inspect web server access logs for unauthenticated POST requests to SigmaForms submission endpoints followed by admin session activity that deletes submissions.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress document root with alerting on deletion events for core PHP files.
- Forward WordPress and web server logs to a centralized SIEM and alert on anomalous plugin submission payloads.
- Track plugin inventory across WordPress fleets to identify hosts still running SigmaForms Pro 1.4.11 or earlier.
How to Mitigate CVE-2026-78657
Immediate Actions Required
- Update SigmaForms Pro to the patched release published by BDThemes as soon as it is available. Consult BDThemes Announcements for release notes.
- Deactivate and remove the plugin on hosts where an update is not yet possible.
- Audit the submissions table and purge any records that contain path traversal sequences before administrators trigger deletion.
- Back up wp-config.php and other critical files, and verify restore procedures.
Patch Information
BDThemes distributes SigmaForms Pro updates through its plugin channel. Administrators should apply the version that supersedes 1.4.11 once released. Verify the installed version under WordPress Plugins after updating. Reference the Wordfence advisory for the confirmed fixed version when publicly listed.
Workarounds
- Restrict access to the SigmaForms submission endpoints at the web application firewall and block requests containing ../ or URL-encoded traversal sequences in upload parameters.
- Do not delete SigmaForms submissions from the admin panel until the plugin is updated, since deletion is the trigger for the file removal.
- Run the WordPress PHP process under a least-privilege account that cannot write to wp-config.php or other core files.
- Enforce filesystem permissions that make wp-config.php read-only for the web server user where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
