Contact Form, Survey, Quiz & Popup Form Builder – ARForms WordPress Plugin Unauthenticated Arbitrary Shortcode Execution Vulnerability

A vulnerability exists in the Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress, allowing for arbitrary shortcode execution. This issue affects all versions of the plugin up to and including 1.7.2. The vulnerability arises because the plugin does not properly validate user input before executing shortcodes, enabling unauthenticated attackers to execute arbitrary shortcodes on the site.

Impact

Exploitation of this vulnerability allows for unauthenticated blind arbitrary shortcode execution, which could be used to execute malicious code or actions on behalf of the user.

Remediation

No known patch is available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.