PT-2019-14854 · WordPress · Arforms

Ahmed Mohamed Almorabea · Published 2019-09-27 · Updated 2021-07-21 · CVE-2019-16902

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ARforms plugin version 3.7.1 for WordPress

Description The issue allows unauthenticated deletion of an arbitrary file by supplying the full pathname through the arf delete file function in arformcontroller.php.

Recommendations For ARforms plugin version 3.7.1, consider disabling the arf delete file function in arformcontroller.php to prevent unauthenticated file deletion until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-16902

Affected Products

Arforms

References · 5

• 🔥 https://exploit-db.com/exploits/47443 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16902 · Vendor Advisory
• https://arformsplugin.com/documentation/changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16902 · Security Note
• http://almorabea.net/cve-2019-16902.txt · Note