The MW WP Form plugin for WordPress is vulnerable to an arbitrary file move flaw caused by insufficient path validation in the 'generate_user_filepath' and 'move_temp_file_to_upload_dir' functions. This flaw permits an unauthenticated attacker to relocate any file on the server if the form includes a file‑upload field and the 'Saving inquiry data in database' option is enabled. By moving critical files such as wp-config.php, an attacker could achieve remote code execution or compromise the site’s configuration.

Vendors and products affected are inc2734:MW WP Form plugin for WordPress. All versions up to and including 5.1.0 are vulnerable.

The vulnerability carries a high severity CVSS score of 8.1. Exploit probability data is not available, and the issue is not listed in the CISA KEV catalog. The attack requires no authentication and relies on the presence of a file‑upload field and a certain form configuration. Given the high CVSS and the potential for remote code execution, the risk is significant for any WordPress site running the affected plugin.