💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

ARforms

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > ARforms

Information

Software Type	Plugin
Software Slug	arforms
Software Status	Active
Software Author	n/a
Software Website	codecanyon.net
Software Record Last Updated	April 30, 2024

12 Vulnerabilities

Submit a Vulnerability

ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change

5.4

CVE-2024-54217

Dec 2, 2024

Researcher: Dave Jong

ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read

7.7

CVE-2024-54216

Dec 2, 2024

Researcher: Dave Jong

ARForms - Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting

6.1

CVE-2024-0427

May 22, 2024

Researcher: Thura Moe Myint (mgthuramoemyint)

ARForms Form Builder <= 6.5 - Unauthenticated Arbitrary File Upload

10.0

CVE-2024-4620

May 17, 2024

Researcher: Thura Moe Myint (mgthuramoemyint)

ARforms <= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-4621

May 17, 2024

Researcher: Bob Matyas

ARforms <= 6.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-32702

Apr 22, 2024

Researcher: Dave Jong

ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2024-32706

Apr 22, 2024

Researcher: Dave Jong

ARForms <= 6.4 - Missing Authorization to Arbitrary Plugin Activation/Deactivation

4.3

CVE-2024-32705

Apr 22, 2024

Researcher: Dave Jong

ARForms <= 6.4 - Missing Authorization to Arbitrary Option Deletion

4.3

CVE-2024-32704

Apr 22, 2024

Researcher: Dave Jong

ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion

8.1

CVE-2024-32703

Apr 22, 2024

Researcher: Dave Jong

ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion

7.5

CVE-2019-16902

Oct 11, 2019

Researcher: AHMAD ALMORABEA

Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

7.5

CVE-2018-15818

Oct 17, 2018

Researcher: Amir Hossein Mahboubi

Title	Status	CVE ID	CVSS	Researchers	Date
ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change	Unpatched	CVE-2024-54217	5.4	Dave Jong	December 2, 2024
ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read	Unpatched	CVE-2024-54216	7.7	Dave Jong	December 2, 2024
ARForms - Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting	Patched	CVE-2024-0427	6.1	Thura Moe Myint (mgthuramoemyint)	May 22, 2024
ARForms Form Builder <= 6.5 - Unauthenticated Arbitrary File Upload	Patched	CVE-2024-4620	10.0	Thura Moe Myint (mgthuramoemyint)	May 17, 2024
ARforms <= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2024-4621	4.4	Bob Matyas	May 17, 2024
ARforms <= 6.4 - Reflected Cross-Site Scripting	Patched	CVE-2024-32702	6.1	Dave Jong	April 22, 2024
ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2024-32706	8.8	Dave Jong	April 22, 2024
ARForms <= 6.4 - Missing Authorization to Arbitrary Plugin Activation/Deactivation	Patched	CVE-2024-32705	4.3	Dave Jong	April 22, 2024
ARForms <= 6.4 - Missing Authorization to Arbitrary Option Deletion	Patched	CVE-2024-32704	4.3	Dave Jong	April 22, 2024
ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion	Patched	CVE-2024-32703	8.1	Dave Jong	April 22, 2024
ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion	Patched	CVE-2019-16902	7.5	AHMAD ALMORABEA	October 11, 2019
Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal	Patched	CVE-2018-15818	7.5	Amir Hossein Mahboubi	October 17, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation