What is the CVSS score of CVE-2026-5436?

CVE-2026-5436 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-5436?

MW WP Form plugin versions 5.1.1 and earlier contain a critical vulnerability allowing unauthenticated attackers to move sensitive WordPress configuration files into publicly accessible web…

How to fix or mitigate CVE-2026-5436?

Within 24 hours: Identify all WordPress sites using MW WP Form plugin and document current version numbers; disable or remove file upload functionality from all affected forms pending remediation. Within 7 days: Contact plugin vendor for patch timeline; if patch becomes available, test in staging environment and deploy to production immediately. Within 30 days: If no patch released, evaluate alternative file upload plugins with confirmed security posture and migrate forms; conduct forensic review of wp-config.php and database access logs for evidence of unauthorized access.

PHP CVE-2026-5436

EUVD-2026-20643 HIGH

Path Traversal (CWE-22)

2026-04-08 Wordfence

GHSA-44gv-5x3q-67mm

PHP Path Traversal WordPress File Upload RCE

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 20:46 euvd

EUVD-2026-20643

Analysis Generated

Apr 08, 2026 - 20:46 vuln.today

CVE Published

Apr 08, 2026 - 20:25 nvd

HIGH 8.1

DescriptionCVE.org

The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter (upload field key) passed to the generate_user_file_dirpath() function, which uses WordPress's path_join() - a function that returns absolute paths unchanged, discarding the intended base directory. The attacker-controlled key is injected via the mwf_upload_files[] POST parameter, which is loaded into the plugin's Data model via _set_request_valiables(). During form processing, regenerate_upload_file_keys() iterates over these keys and calls generate_user_filepath() with the attacker-supplied key as the $name argument - the key survives validation because the targeted file (e.g., wp-config.php) genuinely exists at the absolute path. The _get_attachments() method then re-reads the same surviving keys and passes the resolved file path to move_temp_file_to_upload_dir(), which calls rename() to move the file into the uploads folder. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). The vulnerability is only exploitable if a file upload field is added to the form and the “Saving inquiry data in database” option is enabled.

AnalysisAI

Arbitrary file manipulation in MW WP Form plugin (WordPress) versions ≤5.1.1 allows unauthenticated attackers to move sensitive server files into web-accessible directories, enabling remote code execution. The vulnerability stems from insufficient validation of upload field keys in generate_user_file_dirpath(), exploiting WordPress's path_join() behavior with absolute paths. Attackers inject malicious keys via mwf_upload_files[] POST parameter to relocate critical files like wp-config.php. Exploitation requires forms with enabled file upload fields and 'Saving inquiry data in database' option. No public exploit identified at time of analysis.

Technical ContextAI

CWE-22 path traversal via upload field key injection. The $name parameter passes through _set_request_valiables() into regenerate_upload_file_keys() without absolute path sanitization. WordPress path_join() discards base directory constraints when receiving absolute paths, enabling rename() calls in move_temp_file_to_upload_dir() to relocate arbitrary filesystem resources. Validation succeeds because targeted files exist at specified absolute paths.

RemediationAI

Upgrade MW WP Form plugin to version 5.1.2 or later. Vendor-released patch addresses absolute path handling in upload field key validation (https://plugins.trac.wordpress.org/changeset/3501261/mw-wp-form and https://github.com/web-soudan/mw-wp-form/commit/f872ab18ca670f5867b2241745daa30cd0fab861). As interim mitigation for unpatched systems: disable 'Saving inquiry data in database' option in MW WP Form settings or temporarily deactivate plugin until upgrade completes. Review uploads directory for unauthorized wp-config.php or other system files relocated by potential exploitation. Consult vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e95fe47b8 for additional technical details and detection guidance.