High severity7.5NVD Advisory· Published Sep 27, 2019· Updated Jun 17, 2026

CVE-2019-16902

Description

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Arformsllm-fuzzy
Range: <3.7.1
Package: https://wordpress.org/plugins/arforms
WordPress/ARforms plugindescription
Reputeinfosystems/Arforms
cpe:2.3:a:reputeinfosystems:arforms:3.7.1:*:*:*:*:wordpress:*:*

Patches

Vulnerability mechanics

References

almorabea.net/cve-2019-16902.txtnvdThird Party Advisory
www.arformsplugin.com/documentation/changelog/nvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.008
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000