Arbitrary File Upload Vulnerability in ARForms Plugin for WordPress

CVE-2026-111190

What is CVE-2026-111190?

The ARForms plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to improper handling of user-uploaded files. All versions up to and including 7.2.4 allow attackers to exploit the file upload functionality via a form file-upload handler. An attacker can craft a request containing specific headers, which the plugin does not adequately validate, allowing files (including malicious PHP scripts) to be uploaded to a publicly accessible directory. This vulnerability opens the door for unauthorized file uploads, potentially leading to remote code execution if a form with a File field is exposed publicly.

References