CVE-2026-5436

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.2

Description Unauthenticated attackers can move arbitrary files on the server, potentially leading to remote code execution. The issue occurs when the generate user file dirpath() function fails to properly validate the $name parameter, which is passed via the mwf upload files[] POST parameter and processed by set request valiables(). During form processing, regenerate upload file keys() calls generate user filepath() using the attacker-supplied key. Because the path join() function returns absolute paths unchanged, the intended base directory is discarded. Subsequently, the get attachments() method passes the resolved path to move temp file to upload dir(), which uses rename() to move the file into the uploads folder. This flaw is exploitable only if a file upload field is present in the form and the Saving inquiry data in database option is enabled.

Recommendations Update MW WP Form to version 5.1.2 or later. As a temporary mitigation, disable the Saving inquiry data in database option or remove file upload fields from forms.