ARForms: Unauthenticated arbitrary file upload leading to code execution

Summary

The ARForms form builder plugin for WordPress allows unauthenticated attackers to upload files to the web server through its form file-upload handler. The stored file name comes from an attacker-controlled request header, and the plugin's file-type and content checks can be bypassed, so files containing PHP code can be written to a publicly accessible directory. This may lead to remote code execution, but only if a published form with a File field is publicly accessible on the site. The NVD score is provisional because the record is still deferred.

Affected

• ARForms plugin for WordPress, all versions up to and including 7.2.4

Fixed in

Unknown. No fixed version has been identified in the sources reviewed.

Workaround

• Unpublish forms with a File field or restrict them to logged-in users
• Deactivate the ARForms plugin if file uploads are not business-critical
• Configure the web server so PHP cannot be executed in the WordPress uploads directory and ARForms upload folders
• Place a web application firewall in front of the site and monitor POST requests to the form upload handler

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog
• Observed in the wild: Unknown
• Public proof of concept: Unknown

Our recommendation

• Check whether any public form on each client site contains a File field and remove or restrict it immediately
• Deactivate ARForms where uploads are not required
• Review upload directories for unexpected PHP or script files, new admin users and modified files; restore from a clean backup if compromise is suspected
• Monitor the vendor and Wordfence for a fixed release and update as soon as one is available
• Verify whether pirated (nulled) ARForms copies are in use and replace them with licensed versions

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  im0xfay/CVE-ARFORMS

Research sources

• ARForms changelog (vendor) www.arformsplugin.com
• Wordfence threat intelligence record www.wordfence.com
• OpenCVE CVE-2026-111190 app.opencve.io
• VulDB entry 435688 vuldb.com
• OffSeq threat record CVE-2026-111190 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:21.