---
id: "CVE-2026-111190"
page: "https://infrastack.ai/live/CVE-2026-111190"
kind: "vulnerability"
aliases: ["CVE-2026-111190"]
title: "WordPress ARForms plugin: unauthenticated file upload can lead to code execution"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "arforms", "fixed": ["7.3"], "affected": "<= 7.2.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["arforms", "other", "php", "self-hosted", "wordpress"]
not_affected_if: ["no-public-file-upload-form", "plugin-not-installed"]
published_at: "2026-11-11T08:17:16+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:28:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111190", "first_seen_at": "2026-11-11T08:26:05+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header", "first_seen_at": "2026-11-11T08:28:45+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header", "https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header-vulnerability"]}]
exploit_sources: []
---

# WordPress ARForms plugin: unauthenticated file upload can lead to code execution

Link for people: https://infrastack.ai/live/CVE-2026-111190 (this .md is for agents)

The ARForms WordPress plugin up to and including 7.2.4 lets an unauthenticated visitor upload files through a public form, because the stored file name comes from an attacker-controlled header and the file-type checks can be evaded. Uploaded files containing PHP code can be written to a publicly reachable directory, which may allow remote code execution on the site server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:arforms affected <= 7.2.4 fixed 7.3

## How to check

- Check the installed ARForms plugin version (WordPress admin > Plugins, or the header of wp-content/plugins/arforms/). 7.2.4 or earlier is affected; 7.3 is fixed.
- Check whether any published form has a File upload field reachable without login.
- Look in wp-content/uploads (ARForms folders) for unexpected .php files, and for new admin users.
- Note: the free wordpress.org plugin arforms-form-builder (v1.7.3, closed) is a different slug; the affected slug is 'arforms' (premium).

## Fix

Update ARForms to 7.3 or newer (per Wordfence and Patchstack; vendor changelog not found).

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111190
- 2026-11-11T08:28:45+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header — Fix 7.3 from Wordfence (slug arforms, patched 7.3) and Patchstack; both third-party, vendor changelog (arformsplugin.com) not read, so nothing marked verified. No exploitation or PoC found; Patchstack expects mass exploitation and has a mitigation rule. Sibling XSS CVEs in same <=7.2.4 range.

## Documents

- [advisory] Wordfence: ARForms <= 7.2.4 unauthenticated arbitrary file upload https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/arforms/arforms-724-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header
- [fix] Patchstack: ARForms <= 7.2.4 arbitrary file upload https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header-vulnerability

## From the sources

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_