CVE-2019-16902

HIGH 7.5 CVSS 3.1

Published: September 27, 2019
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-22
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.

Affected products and versions

n/a n/a — Versions not specified
reputeinfosystems arforms — Version 3.7.1

References

almorabea.net http://almorabea.net/cve-2019-16902.txt Third Party Advisory
www.arformsplugin.com https://www.arformsplugin.com/documentation/changelog/ Release Notes, Vendor Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References