ARFORMS · CVE-2026-111190 · Other
FIX → 7.3
The ARForms WordPress plugin up to and including 7.2.4 lets an unauthenticated visitor upload files through a public form, because the stored file name comes from an attacker-controlled header and the file-type checks can be evaded. Uploaded files containing PHP code can be written to a publicly reachable directory, which may allow remote code execution on the site server.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the ARForms plugin at version 7.2.4 or earlier are affected, and only when a published form with a File field is publicly accessible. Sites without the plugin, or without a public form that accepts file uploads, are not exposed through this flaw. The sources do not state a fixed version.
Not affected if no-public-file-upload-form, plugin-not-installed
Who cares arforms, php, self-hosted, wordpress
Upgrade to 7.3
Update ARForms to 7.3 or newer (per Wordfence and Patchstack; vendor changelog not found).
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.