CVE-2026-5436 Details

A vulnerability allowing arbitrary file movement has been identified in the MW WP Form plugin for WordPress, affecting all versions through 5.1.1. The issue arises from inadequate validation of the '$name' parameter, which is the upload field key. This parameter is passed to the 'generate_user_file_dirpath()' function, where it is manipulated by WordPress's 'path_join()' function, returning absolute paths without modification and ignoring the intended base directory. The vulnerability can be exploited by injecting an attacker-controlled key via the 'mwf_upload_files[]' POST parameter. This key is then processed by the plugin's Data model, specifically through the '_set_request_valiables()' method. During form processing, the 'regenerate_upload_file_keys()' function iterates over the uploaded file keys and calls 'generate_user_filepath()' with the injected key. The key bypasses validation because the targeted file, such as 'wp-config.php', exists at the absolute path. Subsequently, the '_get_attachments()' method retrieves the same keys, resolves the file path, and uses 'move_temp_file_to_upload_dir()' to transfer the file to the uploads directory. This vulnerability allows unauthenticated attackers to move arbitrary files on the server, potentially leading to remote code execution if sensitive files like 'wp-config.php' are targeted.

Users are advised to update the MW WP Form plugin to version 5.1.2 or later, where this vulnerability has been patched.