Description
The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). The vulnerability is only exploitable if a file upload field is added to the form and the “Saving inquiry data in database” option is enabled.
Published: 2026-04-02
Score: 8.1 High
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient path validation in the generate_user_filepath and move_temp_file_to_upload_dir functions. Unauthenticated attackers can relocate any file on the server when the form includes a file‑upload field and the “Saving inquiry data in database” option is enabled. If a critical file such as wp-config.php is moved, remote code execution or site compromise can follow.

Affected Systems

Vendors and products affected are the inc2734:MW WP Form plugin for WordPress. All versions up to and including 5.1.0 are vulnerable; newer releases are not affected.

Risk and Exploitability

The flaw has a high severity CVSS score of 8.1 and an EPSS score of 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires no user authentication but relies on the presence of a file‑upload field and a specific form configuration. Given the potential for remote code execution, the risk is significant for any WordPress site that runs the affected plugin.

Generated by OpenCVE AI on June 18, 2026 at 09:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MW WP Form plugin to a version newer than 5.1.0 (at least 5.1.1).
  • If an immediate update is not possible, disable file‑upload functionality on the form or turn off the ‘Saving inquiry data in database’ setting so the vulnerable logic cannot execute.
  • Enforce strict file permissions on the web server so that the web‑server user can only write inside the intended upload directory, reducing the impact of any accidental or malicious file movement.

Generated by OpenCVE AI on June 18, 2026 at 09:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Inc2734
Inc2734 mw Wp Form
Wordpress
Wordpress wordpress
Vendors & Products Inc2734
Inc2734 mw Wp Form
Wordpress
Wordpress wordpress

Thu, 02 Apr 2026 08:00:00 +0000

Type Values Removed Values Added
Description The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). The vulnerability is only exploitable if a file upload field is added to the form and the “Saving inquiry data in database” option is enabled.
Title MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Inc2734 Mw Wp Form
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:37:50.152Z

Reserved: 2026-03-17T16:39:37.224Z

Link: CVE-2026-4347

cve-icon Vulnrichment

Updated: 2026-04-03T13:49:07.146Z

cve-icon NVD

Status : Deferred

Published: 2026-04-02T06:16:23.297

Modified: 2026-06-17T10:56:27.237

Link: CVE-2026-4347

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T09:45:15Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')