https://feed.craftedsignal.io/products/arforms-up-to-and-including-7.2.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:54:16 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-arforms-file-upload-cve-2026-111190/Wed, 11 Nov 2026 13:54:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-arforms-file-upload-cve-2026-111190/The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4, which may allow unauthenticated remote code execution.<p>The ARForms plugin for WordPress (versions up to and including 7.2.4) is vulnerable to arbitrary file upload via its form file-upload handler. The plugin derives the stored filename from an attacker-controlled request header without sufficient restriction. Additionally, file-type and content-safety checks can be evaded, allowing files containing executable PHP code to be written to a publicly accessible directory. This enables unauthenticated attackers to potentially achieve remote code execution. Exploitation requires a published form containing a File field to be publicly accessible.</p> highadvisory