CVE-2018-15818: An issue was discovered in Repute ARForms 3.5.1 and prior.

Security readout for executives and security teams

CVE-2018-15818 affects the WordPress ARForms plugin version 3.5.1 and earlier. A malicious request to WordPress admin-ajax.php can delete files that the web server account can access. This can disrupt a site or damage application files, but the supplied sources do not provide CVSS scoring or confirmed active exploitation. Exposure is likely limited to WordPress sites running ARForms 3.5.1 or earlier with the plugin reachable through normal WordPress AJAX handling. The supplied affected-product metadata is incomplete, so asset validation should rely on installed plugin inventory and version checks. Prioritize remediation for public WordPress sites using ARForms because file deletion can cause outage or site damage. Urgency is high for confirmed vulnerable installs, but broader emergency posture is not supported without evidence of active exploitation or CVSS data. Mitigation focus: Inventory WordPress sites for ARForms installations and exact plugin versions.; Treat ARForms 3.5.1 and earlier as vulnerable until vendor guidance proves otherwise.; Check vendor guidance for a fixed release or official remediation path..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.