CVE-2026-111190: ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
A site is exposed if it runs ARForms version 7.2.4 or earlier and has a published form with a File field that is publicly accessible. No attacker account or other privileges are required.
What must an attacker do to exploit this issue?
The attacker must submit a crafted upload through an accessible ARForms file-upload handler. Exploitation relies on controlling the X-FILENAME request header and bypassing the plugin's file-type and content-safety checks to place PHP-containing content in a publicly accessible directory.
Are sites without public file-upload forms affected in practice?
The vulnerable code is present in affected versions, but the described exploitation path requires a published, publicly accessible form that contains a File field. Removing public access to such forms or removing their File fields prevents the stated unauthenticated attack path.
How can administrators check whether they may be affected?
Check the installed ARForms version and identify published forms containing File fields that are reachable without authentication. Versions up to and including 7.2.4 with such forms meet the stated exposure conditions.