PT-2026-26796 · WordPress · Arforms

Krzysztof Zając · CVE-2024-13785 · Published 2026-03-21 · Updated 2026-03-21

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ARForms versions up to and including 1.7.2

Description The ARForms plugin for WordPress is susceptible to arbitrary shortcode execution. The software does not properly validate input before running the do shortcode function, allowing unauthenticated attackers to execute arbitrary shortcodes.

Recommendations Update ARForms to a version later than 1.7.2.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13785

Affected Products

Arforms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-13785 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8b4a47f7-0161-4a57-994f-c48795810ea3?source=cve · Note
• https://twitter.com/CVEnew/status/2035237267200254271 · Twitter Post
• https://wordpress.org/plugins/arforms-form-builder · Note