CVE-2026-52705: WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the SigmaForms Pro AI Generated Forms WordPress plugin at version 1.4.5 and earlier. The flaw is reachable over the network without any authentication, and exploitation requires satisfying certain environmental or race conditions given the high attack complexity rating. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected system, including the ability to upload and execute arbitrary code. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress HTTP service to exploit this vulnerability.

• AuthenticationNot required

  No account or credentials of any kind are required; the vulnerable file upload endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker acts entirely autonomously against the server-side endpoint; no user action is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on environmental factors such as specific server configurations, race conditions, or file-handling behaviors that the attacker cannot fully control but must account for.

Blast Radius

• A successful attacker uploads and executes arbitrary server-side code, gaining a remote shell on the host running the WordPress application.
• With a remote shell in place, the attacker reads all stored data including database credentials, session tokens, form submissions, and any files accessible to the web server process.
• The attacker modifies or deletes any file the web server process can write, including WordPress core files, plugin files, and stored user data.
• The attacker can crash or destabilize the application server, causing a full service outage for the affected WordPress installation.