The ARForms WordPress plugin up to version 7.2.4 contains an arbitrary file upload vulnerability via its form file-upload handler. An attacker can upload malicious files with executable PHP code by exploiting insufficient validation of file names and bypassing file-type and content checks. This vulnerability allows unauthenticated attackers to potentially achieve remote code execution if a form with a File field is publicly accessible on the site.