CVE-2026-111190

{
  "etk_id": "ETK-2026-4149",
  "cve_id": "CVE-2026-111190",
  "display_id": "CVE-2026-111190",
  "ghsa_id": "GHSA-v7j9-wj6w-8cw7",
  "euvd_id": "EUVD-2026-123272",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file upload in ARForms",
  "summary": "ARForms for WordPress versions through 7.2.4 improperly restrict file uploads submitted through forms. An unauthenticated attacker may place a malicious file on the server and could execute code if a published form with a File field is publicly reachable.",
  "mitigation": "Disable or unpublish publicly accessible ARForms forms that include File fields, and prevent uploaded files from being executed by the web server. Restrict access to upload endpoints and monitor upload directories until a vendor-fixed release is available.",
  "vendor": null,
  "product": "ARforms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 7.2.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ARforms",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.022458133333333335,
  "t0_at": "2026-11-11T07:26:41.208000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T07:48:56.312067+00:00",
      "days": 0.015452593368055555,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T07:26:41.208000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T07:26:41.208000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T07:26:41.208000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111190"
    }
  }
}