The ARForms plugin for WordPress contains a flaw that allows unauthenticated users to pass arbitrary values to the do_shortcode function without proper validation. This weakens the plugin to code injection via WordPress shortcodes, classified as CWE‑94. An attacker can supply any shortcode, which may include functions that reveal sensitive data, modify the site’s content, or trigger additional malicious actions, thereby compromising the confidentiality, integrity, and availability of the affected website.

This vulnerability affects all installations of the ARForms Contact Form, Survey, Quiz & Popup Form Builder plugin produced by reputeinfosystems that are running version 1.7.2 or older. The issue is present in all supported WordPress versions where the plugin is active.

The CVSS score of 5.6 indicates a moderate severity. Attackers can exploit the flaw remotely from any position on the internet since no authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw—unauthenticated arbitrary shortcode execution—suggests a relatively high likelihood of exploitation for attackers who discover the vulnerable endpoint. Mitigating the risk requires immediate patching or removal of the vulnerable plugin functionality.