Executive brief
The MW WP Form plugin for WordPress, which is used to create and manage contact forms, contains a security flaw in how it handles file uploads. An unauthenticated attacker can exploit this to move sensitive system files (like configuration files) into a public folder where they can be read or executed. This could allow an attacker to take full control of the website or access private database credentials.
Technical details
The MW WP Form plugin for WordPress is vulnerable to an arbitrary file move/read flaw due to improper path validation in the generate_user_file_dirpath() function. The root cause is the use of WordPress's path_join() function with an attacker-controlled $name parameter; if the parameter is an absolute path, path_join() returns it unchanged, bypassing the intended base directory restriction. An unauthenticated attacker can inject an absolute path via the mwf_upload_files[] POST parameter. During form processing, the plugin validates the path's existence and subsequently uses rename() to move the targeted file into the public uploads directory. This can lead to remote code execution if sensitive files like wp-config.php are moved. The vulnerability requires a form with a file upload field and the 'Saving inquiry data in database' option enabled. A fix is available in version 5.1.2.
Affected products
- inc2734 MW WP Form up to and including 5.1.1
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in version 5.1.2
- 2026-04-08: advisory
References
- https://github.com/web-soudan/mw-wp-form/commit/f872ab18ca670f5867b2241745daa30cd0fab861
- https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.data.php
- https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.directory.php
- https://plugins.trac.wordpress.org/changeset/3501261/mw-wp-form
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e95fe47b8?source=cve