CVE-2026-4347 - Vulnerability Analysis

Overview

MW WP Form plugin for WordPress <= 5.1.0 contains an arbitrary file moving vulnerability caused by insufficient file path validation in 'generate_user_filepath' and 'move_temp_file_to_upload_dir' functions, letting unauthenticated attackers move arbitrary files on the server, exploit requires a file upload field and enabled database saving option.

Severity & Score

Impact

Unauthenticated attackers can move arbitrary files on the server, potentially leading to remote code execution.

Mitigation

Update to the latest version beyond 5.1.0.

References

• https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.0/classes/controllers/class.main.php#L271
• https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.0/classes/models/class.directory.php#L138
• https://www.wordfence.com/threat-intel/vulnerabilities/id/194ee4a0-87c3-42e5-9676-8dd355838b78?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner