Arbitrary File Moving Vulnerability in MW WP Form Plugin by WordPress
CVE-2026-4347
What is CVE-2026-4347?
The MW WP Form plugin for WordPress is susceptible to arbitrary file moving due to inadequate validation of file paths in its functions, particularly 'generate_user_filepath' and 'move_temp_file_to_upload_dir'. This vulnerability affects all versions up to and including 5.1.0. Attackers without authentication may exploit this flaw to manipulate files on the server, which poses a severe risk of remote code execution if sensitive files, such as wp-config.php, are moved. The exploit requires a file upload field to be present in the form and the activation of the 'Saving inquiry data in database' option.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
MW WP Form 0 <= 5.1.0