Arbitrary file upload in Arforms

CVE-2026-111190

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.

Vulnerability class: Unrestricted File Upload

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.006, 46.7th percentile (scored ). About EPSS.

Affected products

  • Arforms

Weakness classification (CWE)

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

  • im0xfay/CVE-ARFORMS (last pushed 2026-11-12): ARForms unauth file upload → RCE PoCs (CVE-2026-111190 / 12424 / 12427) — ARForms 7.x + 6.x, docker lab, verified wire formats

References

This CVE has public exploit evidence. See the latest CVEs with public exploits.