Mw Wp Form CVE-2026-4347

MW WP Form plugin versions up to 5.1.0 with a form containing a file upload field AND the 'Saving inquiry data in database' option enabled. Unauthenticated remote attacker can exploit without user interaction. Arbitrary file movement leads to RCE via wp-config.php manipulation.

Real-world risk is HIGH despite the high attack complexity designation (AC:H) in the CVSS vector. The unauthenticated attack vector (AV:N, PR:N) with no user interaction (UI:N) requirement makes this exploitable remotely without credentials, significantly lowering the barrier to exploitation. The AC:H rating reflects preconditions (file upload field existence and database storage enabled), but these are common configurations for contact forms collecting attachments. The impact severity is maximum across all CIA triad components (C:H/I:H/A:H), justified by the remote code execution outcome. While no EPSS score or KEV status was provided to confirm active exploitation patterns, Wordfence's public documentation with exact source code line references substantially reduces discovery difficulty for threat actors. The WordPress ecosystem's large attack surface and automated scanning prevalence means vulnerable installations will likely be identified and exploited once proof-of-concept code circulates. Organizations using MW WP Form with file upload capabilities face immediate risk and should prioritize remediation. The SSVC framework would likely categorize this as automatable with high technical impact, warranting urgent action despite the conditional preconditions.

An unauthenticated remote attacker identifies a WordPress site running MW WP Form 5.1.0 with a contact form configured for file uploads and database inquiry storage. The attacker crafts a malicious HTTP request to the form submission endpoint, manipulating file path parameters in the 'generate_user_filepath' function to traverse directories and target wp-config.php. By exploiting insufficient validation in 'move_temp_file_to_upload_dir', the attacker relocates wp-config.php from the WordPress root to the wp-content/uploads directory, making database credentials readable via direct HTTP request. Alternatively, the attacker moves a legitimate uploaded file containing PHP webshell code to a location where it can be executed directly (such as the active theme directory), achieving immediate remote code execution with web server privileges. The high attack complexity reflects the need for specific form configurations, but once identified, exploitation is straightforward with direct network access and no authentication barriers.