ARForms (Up to and Including 7.2.4)

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4, which may allow unauthenticated remote code execution.