CVE-2026-5436 - Vulnerability Analysis

Overview

MW WP Form plugin for WordPress <= 5.1.1 contains an arbitrary file move/read vulnerability caused by insufficient validation of the $name parameter in generate_user_file_dirpath(), letting unauthenticated attackers move arbitrary files on the server, exploit requires a file upload field in the form and enabled saving inquiry data in database option.

Severity & Score

Impact

Unauthenticated attackers can move arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Update to the latest version of MW WP Form plugin.

References

• https://plugins.trac.wordpress.org/changeset/3501261/mw-wp-form
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e95fe47b8?source=cve
• https://github.com/web-soudan/mw-wp-form/commit/f872ab18ca670f5867b2241745daa30cd0fab861
• https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.data.php#L591
• https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.directory.php#L138

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner