The MW WP Form plugin for WordPress contains a flaw that lets an unauthenticated attacker move any file on the server. The problem occurs because the plugin does not properly validate the file key supplied in the mwf_upload_files[] POST parameter; the path resolution routine keeps an absolute path and later a rename operation copies the file into the uploads directory. An attacker can therefore relocate sensitive files, such as wp-config.php, into a web‑exposed folder and enable further exploitation. This weakness is a classic Arbitrary File Move (CWE‑22) and can result in remote code execution when critical files are moved to publicly accessible locations.

All installations of the inc2734 MW WP Form plugin that are version 5.1.1 or earlier. An attack is possible only when the form contains at least one file upload field and the "Saving inquiry data in database" setting is enabled. The vulnerability applies to any WordPress site that uses such a form and has not yet applied the official update.

The flaw carries a CVSS score of 8.1, indicating a high severity vulnerability, and is marked as unauthenticated, meaning no user credentials are required. While an EPSS score is not currently available and the vulnerability has not yet been listed in the CISA KEV catalog, the straightforward exploitation path—sending a crafted POST request with an absolute file key—makes the risk significant. Attackers could move privileged files, expose them via the uploads directory, and potentially execute remote code. Environmental factors such as the presence of a file upload field and the database‑saving option are the only prerequisites for exploitation.