CVE-2026-3652 Overview
CVE-2026-3652 is a Stored Cross-Site Scripting (XSS) vulnerability in the ARForms WordPress form builder plugin. The flaw resides in the value parameter handled by the arf_save_incomplete_form_data AJAX action. All plugin versions up to and including 7.1.3 are affected. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The payload executes when an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard. The weakness is tracked as [CWE-79].
Critical Impact
Unauthenticated attackers can store JavaScript that executes in the administrator's browser, enabling session hijacking, privilege abuse, and full WordPress site takeover through admin-context actions.
Affected Products
- ARForms WordPress form builder plugin, all versions up to and including 7.1.3
- WordPress sites with the ARForms "Partial Filled Form Entries" feature enabled
- Administrator accounts viewing ARForms dashboard pages
Discovery Timeline
- 2026-06-24 - CVE-2026-3652 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-3652
Vulnerability Analysis
The ARForms plugin exposes the arf_save_incomplete_form_data AJAX endpoint to save partially completed form submissions. This endpoint is reachable by unauthenticated users so that visitors can resume forms later. The handler accepts a value parameter and persists it to the database without sufficient sanitization. The plugin then renders the stored content on the "Partial Filled Form Entries" administrative page without proper output escaping. An attacker who submits a crafted value containing HTML or JavaScript stores the payload server-side. When an administrator opens the entries page, the browser parses the payload as active content and executes it within the WordPress admin origin.
Root Cause
The root cause is a combination of missing input sanitization at write time and missing contextual output escaping at render time. WordPress provides functions such as sanitize_text_field() for input cleansing and esc_html() or esc_attr() for context-aware output. The vulnerable code path does not apply these protections to the value parameter, allowing raw markup to flow from the AJAX request into the admin DOM.
Attack Vector
The attack is network-based and requires no authentication or user interaction beyond an administrator visiting the entries page. An attacker sends an unauthenticated POST request to admin-ajax.php targeting the arf_save_incomplete_form_data action and includes a malicious script in the value parameter. The payload remains stored until an administrator triggers execution by viewing partial entries. Because execution occurs in the admin browser session, the attacker can perform privileged operations such as creating administrator accounts, modifying plugin settings, or injecting backdoors into theme files.
No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-3652
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with action=arf_save_incomplete_form_data from unauthenticated sources.
- Stored form entries containing <script>, onerror=, onload=, or javascript: substrings in the ARForms partial entries table.
- New or unexpected WordPress administrator accounts created shortly after an admin viewed the "Partial Filled Form Entries" page.
- Modified plugin or theme files with injected JavaScript loaders or remote script tags.
Detection Strategies
- Inspect database tables used by ARForms for partial entries and search the value column for HTML tags or event handler attributes.
- Review web server access logs for unauthenticated requests to admin-ajax.php containing the arf_save_incomplete_form_data action.
- Deploy a Web Application Firewall (WAF) rule that blocks script-like payloads in form submissions to the vulnerable AJAX action.
Monitoring Recommendations
- Alert on creation of new WordPress users with the administrator role outside of approved change windows.
- Monitor outbound network connections from the WordPress host to unfamiliar domains referenced by inline scripts.
- Track plugin and theme file integrity using checksums and alert on unexpected modifications.
How to Mitigate CVE-2026-3652
Immediate Actions Required
- Update the ARForms plugin to a version newer than 7.1.3 as soon as the vendor publishes a fix.
- Disable or deactivate ARForms if a patched release is not yet available and the partial entries feature is in use.
- Audit existing partial form entries and purge any records containing script payloads.
- Rotate administrator credentials and review all admin user accounts for unauthorized additions.
Patch Information
Reference the Wordfence Vulnerability Report and the CodeCanyon Plugin Overview for vendor update guidance. Apply the fixed release on all WordPress sites running ARForms version 7.1.3 or earlier.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php?action=arf_save_incomplete_form_data at the WAF or reverse proxy until a patch is applied.
- Disable the "Partial Filled Form Entries" feature in ARForms settings if the workflow is not required.
- Apply a Content Security Policy (CSP) that blocks inline scripts in the WordPress admin interface to reduce exploitation impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
