CVE-2024-54216
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The ARForms WordPress plugin contains a path traversal vulnerability, allowing an attacker to read files outside the application's root directory. The issue affects versions before 7.0.2.
Risk Assessment
An attacker can exploit the vulnerability to read sensitive configuration files or data, potentially leading to information disclosure and further attack escalation.
Recommendation
Immediately update the ARForms plugin to version 7.0.2 or later, which includes a fix for the vulnerability.
Other vulnerabilities in ARForms
See all- CVE-2026-57338High
The ARForms plugin version 7.1.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2024-13784Critical
The ARForms plugin for WordPress up to version 1.8.5 is vulnerable to PHP Object Injection via deserialization of untrusted input from form submissions. This allows unauthenticated attackers to inject a PHP object, but without a POP chain in the plugin itself, there is no impact unless another plugin or theme with a POP chain is installed.
- CVE-2026-12421High
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.