ARForms: Arbitrary file upload vulnerability (CVE-2026-111190)

The ARForms plugin for WordPress (versions up to and including 7.2.4) is vulnerable to arbitrary file upload via its form file-upload handler. The plugin derives the stored filename from an attacker-controlled request header without sufficient restriction. Additionally, file-type and content-safety checks can be evaded, allowing files containing executable PHP code to be written to a publicly accessible directory. This enables unauthenticated attackers to potentially achieve remote code execution. Exploitation requires a published form containing a File field to be publicly accessible.