Security Alert Summary
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress contains an arbitrary shortcode execution vulnerability in all versions up to and including 1.7.2. The issue allows an unauthenticated user to trigger execution of shortcodes because a value is not properly validated before being passed to do_shortcode.
CVE Details
- CVE ID: CVE-2024-13785
- Affected plugin or component: The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress
- Affected versions: all versions up to, and including, 1.7.2
- Published date: March 21, 2026 at 04:16:47 AM UTC
- Last modified date: March 21, 2026 at 04:16:47 AM UTC
- CVSS v3.1: Base Score 5.6, MEDIUM; Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Authentication / Privileges / User interaction: Authentication: none; Privileges required: none; User interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: Low
- CWE / weakness: CWE-94 (Improper Control of Generation of Code)
Technical Details
The plugin allows execution of an action that does not properly validate a value before calling do_shortcode. Because do_shortcode processes shortcode content, an attacker can supply input that results in arbitrary shortcode execution. The vulnerability is reachable by unauthenticated actors and is present in all plugin versions through 1.7.2.
The root cause is missing or insufficient validation of a value that is later passed to the WordPress shortcode processor. The description identifies do_shortcode as the function used to execute the shortcode content; the lack of validation before that call enables the behaviour.
Impact is limited to what an executed shortcode can do on a given site. This may include disclosure of information exposed to shortcode handlers or actions those shortcodes perform. The CVSS metrics indicate low impacts to confidentiality, integrity, and availability, and no privileges are required to trigger the condition.
How This Could Impact Your Website
Consider a site with a small team: a site owner, an internal content editor, and an external contractor who builds forms. If an unauthenticated attacker can trigger shortcode execution via ARForms, handlers registered for shortcodes could be invoked with attacker-controlled input. This could lead to disclosure of data accessible to those shortcode handlers (for example, internal user email addresses or form contents) or execution of actions those shortcodes perform within the limits of what the shortcode code allows.
Practically, the most likely consequences are limited information disclosure and increased risk of targeted phishing or social engineering against staff and contractors, consistent with the CVSS low confidentiality and integrity impact ratings. The vulnerability does not, based on the available data, indicate automatic full site compromise or arbitrary code execution outside of shortcode handlers.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege users who can interact with forms.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to form submissions and shortcode execution.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
