CVE-2026-111190

The ARForms plugin for WordPress (versions up to and including 7.2.4 ) is vulnerable to an unauthenticated arbitrary file upload via its form file-upload handler. The root cause is that the plugin retrieves the stored filename from an attacker-controlled request header without sufficient restrict...