CVE-2019-16902: Improper Limitation of a Pathname to a Restricted Directory

In the ARforms plugin 3.7.1 for WordPress, arfdeletefile in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname...