{"id":"CVE-2026-111190","kind":"vulnerability","aliases":["CVE-2026-111190"],"related":[],"title":"WordPress ARForms plugin: unauthenticated file upload can lead to code execution","description":"The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.","summary":"The ARForms WordPress plugin up to and including 7.2.4 lets an unauthenticated visitor upload files through a public form, because the stored file name comes from an attacker-controlled header and the file-type checks can be evaded. Uploaded files containing PHP code can be written to a publicly reachable directory, which may allow remote code execution on the site server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"arforms","fixed":["7.3"],"affected":"<= 7.2.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["arforms","other","php","self-hosted","wordpress"],"not_affected_if":["no-public-file-upload-form","plugin-not-installed"],"how_to_check":"- Check the installed ARForms plugin version (WordPress admin > Plugins, or the header of wp-content/plugins/arforms/). 7.2.4 or earlier is affected; 7.3 is fixed.\n- Check whether any published form has a File upload field reachable without login.\n- Look in wp-content/uploads (ARForms folders) for unexpected .php files, and for new admin users.\n- Note: the free wordpress.org plugin arforms-form-builder (v1.7.3, closed) is a different slug; the affected slug is 'arforms' (premium).","fix":"Update ARForms to 7.3 or newer (per Wordfence and Patchstack; vendor changelog not found).","status":"open","published_at":"2026-11-11T08:17:16+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:48+00:00","updated_at":"2026-11-11T08:28:45+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T08:27:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress ARForms plugin: unauthenticated file upload can lead to code execution","impact":"high","summary":"The ARForms WordPress plugin up to and including 7.2.4 lets an unauthenticated visitor upload files through a public form, because the stored file name comes from an attacker-controlled header and the file-type checks can be evaded. Uploaded files containing PHP code can be written to a publicly reachable directory, which may allow remote code execution on the site server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","arforms","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs PHP code on the web server","analyst_note":"Find the fixed version and vendor advisory for ARForms after 7.2.4 (check the plugin's WordPress.org changelog and the NVD entry) to complete the fix field.","how_to_check":"- Check the installed ARForms plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` (the plugin's main file header).\n- Check whether any published form contains a File upload field and is publicly accessible.\n- Look in the plugin's upload directories for unexpected `.php` files.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-file-upload-form"],"who_is_affected":"Sites running the ARForms plugin at version 7.2.4 or earlier are affected, and only when a published form with a File field is publicly accessible. Sites without the plugin, or without a public form that accepts file uploads, are not exposed through this flaw. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4669,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and vendor advisory for ARForms after 7.2.4 (check the plugin's WordPress.org changelog and the NVD entry) to complete the fix field.","search":"'-111190':14A,17A '-2026':13A,16A '7.2.4':34B,107C 'access':167C,205C 'adequ':133C 'affect':182C 'allow':81B,154C 'arbitrari':97C 'arform':2A,19B,27B,90C 'arforms':18A 'attack':54B,126C,175C 'attacker-control':53B,125C 'check':62B,150C 'code':10A,70B,83B,160C,190C 'come':50B 'contain':68B,157C,198C 'content':148C 'content-safeti':147C 'control':55B,127C 'cve':12A,15A 'directori':78B,168C 'evad':65B,153C 'execut':11A,84B,158C,191C 'exploit':193C 'field':201C 'file':5A,40B,48B,60B,67B,98C,112C,120C,137C,144C,155C,179C,200C 'file-typ':59B,143C 'file-upload':111C 'form':44B,110C,197C 'handler':114C 'header':56B,129C 'host':24B 'includ':33B,106C 'lead':8A 'let':35B 'make':170C,188C 'malici':178C 'may':80B,187C 'name':49B,116C 'php':21B,69B,159C 'plugin':3A,29B,91C,141C 'possibl':172C,192C 'public':43B,76B,166C,204C 'publish':196C 'reachabl':77B 'remot':82B,189C 'request':128C 'requir':194C 'restrict':134C 'safe':136C 'safeti':149C 'self':23B 'self-host':22B 'server':88B,185C 'site':87B,183C,208C 'store':47B,119C 'taken':122C 'type':61B,138C,145C 'unauthent':4A,37B,174C 'upload':6A,39B,66B,99C,113C,177C 'version':102C 'via':108C 'visitor':38B 'vulner':95C 'wordpress':1A,25B,28B,93C 'written':73B,163C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ARForms plugin at version 7.2.4 or earlier are affected, and only when a published form with a File field is publicly accessible. Sites without the plugin, or without a public form that accepts file uploads, are not exposed through this flaw. The sources do not state a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["arforms"],"ptokens":["arforms"],"labels":["arforms","high","other","php","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-111190':14A,17A '-2026':13A,16A 'arform':2A 'arforms':18A 'code':10A 'cve':12A,15A 'execut':11A 'file':5A 'lead':8A 'plugin':3A 'unauthent':4A 'upload':6A 'wordpress':1A","search_b":"'7.2.4':34B 'allow':81B 'arform':19B,27B 'attack':54B 'attacker-control':53B 'check':62B 'code':70B,83B 'come':50B 'contain':68B 'control':55B 'directori':78B 'evad':65B 'execut':84B 'file':40B,48B,60B,67B 'file-typ':59B 'form':44B 'header':56B 'host':24B 'includ':33B 'let':35B 'may':80B 'name':49B 'php':21B,69B 'plugin':29B 'public':43B,76B 'reachabl':77B 'remot':82B 'self':23B 'self-host':22B 'server':88B 'site':87B 'store':47B 'type':61B 'unauthent':37B 'upload':39B,66B 'visitor':38B 'wordpress':25B,28B 'written':73B","search_c":"'7.2.4':107C 'access':167C,205C 'adequ':133C 'affect':182C 'allow':154C 'arbitrari':97C 'arform':90C 'attack':126C,175C 'attacker-control':125C 'check':150C 'code':160C,190C 'contain':157C,198C 'content':148C 'content-safeti':147C 'control':127C 'directori':168C 'evad':153C 'execut':158C,191C 'exploit':193C 'field':201C 'file':98C,112C,120C,137C,144C,155C,179C,200C 'file-typ':143C 'file-upload':111C 'form':110C,197C 'handler':114C 'header':129C 'includ':106C 'make':170C,188C 'malici':178C 'may':187C 'name':116C 'php':159C 'plugin':91C,141C 'possibl':172C,192C 'public':166C,204C 'publish':196C 'remot':189C 'request':128C 'requir':194C 'restrict':134C 'safe':136C 'safeti':149C 'server':185C 'site':183C,208C 'store':119C 'taken':122C 'type':138C,145C 'unauthent':174C 'upload':99C,113C,177C 'version':102C 'via':108C 'vulner':95C 'wordpress':93C 'written':163C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111190","severity":null,"published_at":"2026-11-11T08:17:16+00:00","modified_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111190:3520","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header","severity":null,"published_at":"2026-11-11T08:28:45+00:00","modified_at":"2026-11-11T08:28:45+00:00","first_seen_at":"2026-11-11T08:28:45+00:00","fetched_at":"2026-11-11T08:28:45+00:00","note":"Fix 7.3 from Wordfence (slug arforms, patched 7.3) and Patchstack; both third-party, vendor changelog (arformsplugin.com) not read, so nothing marked verified. No exploitation or PoC found; Patchstack expects mass exploitation and has a mitigation rule. Sibling XSS CVEs in same <=7.2.4 range.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header","https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header-vulnerability"]}],"documents":[{"id":124003,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header","title":"Wordfence: ARForms <= 7.2.4 unauthenticated arbitrary file upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":124004,"url":"https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header-vulnerability","title":"Patchstack: ARForms <= 7.2.4 arbitrary file upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}