WordPress - Sigmaforms Pro – Ai Generated Forms - CRITICAL - CVE-2026-14494. The Sigma Forms Pro plugin for WordPress is susceptible to Remote Code Execution due to the improper handling of user permissions during form submissions. The plugin inadvertently grants the unfiltered_upload capability to all users, allowing unauthenticated attackers to upload potentially malicious files. This vulnerability is particularly concerning as it bypasses MIME type validation when acceptable file types are not configured. Several built-in templates, including Job Application, Support Ticket, and Wholesale Application, include file upload fields that lack restrictions, rendering this vulnerability highly exploitable immediately upon installation of the plugin.