Arbitrary File Deletion Vulnerability in MW WP Form Plugin for WordPress

CVE-2023-6559

Summary

The MW WP Form plugin for WordPress exposes a critical flaw that allows unauthenticated users to delete files from the server, including sensitive files like wp-config.php. This vulnerability arises from a lack of proper validation on the file paths of uploads before deletion. As a result, attackers can exploit this weakness to gain unauthorized access to critical areas of a website, potentially leading to site takeover or remote code execution. Website administrators are strongly advised to update to the latest version to mitigate this risk.

References