Loading vulnerability…
CVE-2026-5436 is an unauthenticated path traversal vulnerability in the MW WP Form plugin for WordPress affecting all versions up to and including 5.1.1. The flaw is caused by insufficient validation of the attacker-controlled upload field key passed as the $name parameter to generate_user_file_dirpath(), which uses WordPress's path_join(). Because path_join() returns absolute paths unchanged, an attacker can supply an absolute filesystem path via the mwf_upload_files[] POST parameter and bypass the intended base-directory restriction. The crafted key is loaded into the plugin's Data model via _set_request_valiables(), survives processing in regenerate_upload_file_keys(), and is later re-used by _get_attachments(), which passes the resolved path to move_temp_file_to_upload_dir(). That function ultimately calls rename(), causing the targeted file to be moved into the WordPress uploads directory. The issue can also expose file contents through the plugin's handling of the referenced file path. The vulnerability is only exploitable when a form contains a file upload field and the "Saving inquiry data in database" option is enabled for that form.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A path traversal vulnerability in MW WP Form. The content notes testing was reduced to version detection only because arbitrary file move behavior is destructive.
An unauthenticated path traversal/arbitrary file move vulnerability in the MW WP Form WordPress plugin that allows attackers to move arbitrary files such as wp-config.php into the public uploads directory via crafted upload field keys.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.