Arbitrary File Move/Read Vulnerability in MW WP Form Plugin for WordPress

CVE-2026-5436

What is CVE-2026-5436?

The MW WP Form plugin for WordPress features a vulnerability that allows attackers to manipulate files on the server. This stems from inadequate validation of the $name parameter from the file upload field in the generate_user_file_dirpath() function. An attacker can inject a key via the mwf_upload_files[] POST parameter, enabling unwanted file movement within the server. Particularly concerning is that if sensitive files like wp-config.php are targeted, it may lead to unauthorized remote code execution. This issue arises specifically when a file upload field is included in the form and the option to save inquiry data in the database is enabled.

References