What is the CVSS score of CVE-2026-4347?

CVE-2026-4347 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-4347?

MW WP Form plugin versions 5.1.0 and below contain an arbitrary file movement vulnerability that enables unauthenticated attackers to relocate critical WordPress configuration files and execute…

How to fix or mitigate CVE-2026-4347?

Within 24 hours: audit all WordPress instances for MW WP Form plugin presence and version (check wp-content/plugins directory and admin dashboard). Within 7 days: immediately disable or remove MW WP Form plugin versions ≤5.1.0; if the plugin is business-critical, restrict file upload form access to authenticated users only via web application firewall rules and disable database inquiry storage in plugin settings. Within 30 days: monitor vendor (MW WP Form developer) advisory channels for patch release; evaluate alternative form plugins that are actively maintained with security updates.

PHP CVE-2026-4347

EUVD-2026-18124 HIGH

Path Traversal (CWE-22)

2026-04-02 Wordfence

GHSA-2mhf-8wh4-g2p3

WordPress PHP Path Traversal RCE File Upload

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 05:45 euvd

EUVD-2026-18124

Analysis Generated

Apr 02, 2026 - 05:45 vuln.today

CVE Published

Apr 02, 2026 - 05:28 nvd

HIGH 8.1

DescriptionCVE.org

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). The vulnerability is only exploitable if a file upload field is added to the form and the “Saving inquiry data in database” option is enabled.

AnalysisAI

Arbitrary file movement in MW WP Form plugin for WordPress (all versions ≤5.1.0) allows unauthenticated remote attackers to relocate server files and achieve remote code execution by moving critical files like wp-config.php. Exploitation requires a form with file upload capability and database inquiry storage enabled. CVSS 8.1 with network attack vector and high attack complexity. EPSS data not provided; no public exploit or CISA KEV status identified at time of analysis, though Wordfence threat intelligence has documented the vulnerability with source code references.

Technical ContextAI

This vulnerability stems from inadequate path validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in two functions within the MW WP Form plugin: 'generate_user_filepath' and 'move_temp_file_to_upload_dir'. The plugin, identified by CPE cpe:2.3:a:inc2734:mw_wp_form, processes file uploads through forms and conditionally saves inquiry data to the database. When both file upload fields are present and the database storage option is active, attackers can manipulate file path parameters to move files outside intended directories. The vulnerability manifests in the Main controller class (class.main.php line 271) and Directory model class (class.directory.php line 138), where insufficient sanitization of user-controlled file paths enables path traversal. By moving security-critical files like WordPress configuration files (wp-config.php) to web-accessible directories, attackers can read database credentials or overwrite files with malicious PHP code, converting a file movement primitive into full remote code execution.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from provided data. Administrators should immediately check for updates to MW WP Form plugin beyond version 5.1.0 through the WordPress plugin repository and apply the latest available version. As an interim mitigation, disable the 'Saving inquiry data in database' option in MW WP Form settings to eliminate the vulnerable code path, though this may impact form data retention requirements. Alternatively, temporarily disable file upload fields on forms using this plugin until patching is complete. Organizations should audit web server file permissions to ensure wp-config.php and other critical WordPress core files are not writable by the web server process, implementing defense-in-depth against file movement attacks. Monitor web server logs for unusual file access patterns or modifications to core WordPress files. Review forms created with MW WP Form to identify which installations meet exploitation preconditions (file upload enabled with database storage). Consult the WordPress plugin repository changelog and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/194ee4a0-87c3-42e5-9676-8dd355838b78 for updated remediation guidance and confirmed patch versions.