Advisory · CVE-2026-111190
ARForms file upload flaw lets unauthenticated attackers run code on WordPress sites
ARForms up to and including 7.2.4 lets unauthenticated attackers upload executable PHP files through a form's file field, leading to remote code execution. Fixed in 7.3.
- Vendor
- ARForms
- Product
- ARForms
- Identifier / CWE
- CVE-2026-111190
CWE-434 - Action timing
- Immediate
Explain it like I’m five
ARForms lets visitors attach files to a form, and it decides the saved file's name from a header the visitor controls. It does not properly restrict which file types are allowed, so an attacker can upload a PHP file to a public folder and then open it in a browser to run code on the server.
- 01Public form with a file field
A site publishes an ARForms form containing a File field that visitors can reach without logging in.
- 02Upload with a chosen name
An unauthenticated attacker submits the form with a file whose stored name comes from an attacker-controlled request header.
- 03Type checks evaded
The plugin's file-type and content-safety checks can be evaded, so a file containing executable PHP code is accepted.
- 04Code runs on the server
The PHP file is written to a publicly accessible directory. Requesting it in a browser executes the code on the site's server.
What happened
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 7.2.4. The form file-upload handler takes the name of the stored file from an attacker-controlled request header and does not adequately restrict it to safe file types. The plugin’s file-type and content-safety checks can be evaded, allowing files containing executable PHP code to be written to a publicly accessible directory. An unauthenticated attacker can then request the uploaded file and achieve remote code execution on the site’s server. Exploitation requires a published form containing a File field to be publicly accessible.
Fixed in ARForms 7.3, released 7 November 2026.
What to do
- Update ARForms to 7.3 or later.
- Audit the uploads directory for unexpected PHP files, especially any uploaded through forms with a File field.
- Review server access logs for requests to uploaded files that should never have been executed.
- If the update cannot be applied immediately, take forms with a File field offline or restrict them to logged-in users.
Management note
Unauthenticated file upload to code execution is one of the shortest paths to a fully compromised WordPress site, and the only precondition is a public form with a file field. The fix is a one-click update, so the gap to close is the time between now and the next update run.