Loading vulnerability…
Arbitrary File Move in MW WP Form for WordPress
CVE-2026-4347 is an arbitrary file moving vulnerability in the MW WP Form plugin for WordPress affecting all versions up to and including 5.1.0. The issue is caused by insufficient file path validation in the generate_user_filepath and move_temp_file_to_upload_dir functions. An unauthenticated attacker can abuse the vulnerable file-handling logic to cause arbitrary files on the server to be moved. The provided context specifically notes that moving a sensitive file such as wp-config.php can turn the issue into remote code execution. The flaw is only reachable in deployments where a form includes a file upload field and the plugin option for saving inquiry data in the database is enabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to move arbitrary files on the server. This can compromise confidentiality, integrity, and availability depending on which file is moved. In the documented worst case, moving a sensitive file such as wp-config.php can lead to remote code execution. The supplied CVSS context also indicates high impact across confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or removing file upload fields from MW WP Form forms and disabling the "Saving inquiry data in database" option, since the vulnerability is only exploitable when both conditions are present. Restrict public access to vulnerable forms where feasible and monitor for unexpected movement of sensitive files such as wp-config.php.
Patch, then assume compromise.
Update the MW WP Form plugin to a version newer than 5.1.0. The provided context identifies all versions up to and including 5.1.0 as affected, so remediation is to deploy a fixed release that addresses the insufficient file path validation in generate_user_filepath and related file-moving logic.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.