An arbitrary file upload issue exists due to missing server-side file extension validation within the `cbforms check form submissions()` function. When no field restriction is configured, the allowed-type check defaults to the extension of the uploaded file, allowing the upload of executable files such as .php. This enables unauthenticated attackers to achieve remote code execution. The submission nonce used for validation is printed inline on public pages, making it easily obtainable by unauthenticated visitors.