CVE-2026-4347: MW WP Form WordPress Plugin RCE Vulnerability

CVE-2026-4347 Overview

The MW WP Form plugin for WordPress contains an arbitrary file moving vulnerability due to insufficient file path validation in the generate_user_filepath function and the move_temp_file_to_upload_dir function. This path traversal flaw (CWE-22) affects all versions up to and including 5.1.0, allowing unauthenticated attackers to move arbitrary files on the server. When exploited, this can lead to remote code execution by moving critical configuration files such as wp-config.php.

Critical Impact

Unauthenticated attackers can achieve remote code execution by moving sensitive server files, potentially compromising the entire WordPress installation and underlying server.

Affected Products

• MW WP Form plugin for WordPress versions ≤ 5.1.0
• WordPress installations with MW WP Form configured with file upload fields
• Sites with "Saving inquiry data in database" option enabled

Discovery Timeline

• 2026-04-02 - CVE-2026-4347 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-4347

Vulnerability Analysis

This vulnerability stems from a path traversal weakness in the MW WP Form plugin's file handling mechanism. The plugin fails to properly validate and sanitize file paths when processing uploaded files through forms. Specifically, the generate_user_filepath function in the controller class and the move_temp_file_to_upload_dir function in the directory model do not adequately restrict the destination paths for file operations.

The vulnerability requires specific conditions to be exploitable: a file upload field must be present in the form configuration, and the "Saving inquiry data in database" option must be enabled. When these conditions are met, an attacker can manipulate file path parameters to move files to arbitrary locations on the server.

Root Cause

The root cause lies in insufficient input validation and path canonicalization within the plugin's file handling functions. The generate_user_filepath function located at classes/controllers/class.main.php (line 271) and the move_temp_file_to_upload_dir function in classes/models/class.directory.php (line 138) fail to properly sanitize user-controlled path components, allowing directory traversal sequences to escape the intended upload directory.

Attack Vector

The attack is network-accessible and requires no authentication, though it has high attack complexity due to the prerequisite configuration requirements. An attacker must identify a WordPress site running a vulnerable version of MW WP Form with both a file upload field configured and the database storage option enabled.

The exploitation flow involves submitting a crafted form request that includes directory traversal sequences in the file path parameters. By manipulating these values, attackers can direct the plugin to move files from one location to another on the server. A particularly dangerous scenario involves moving the wp-config.php file to a web-accessible directory, potentially exposing database credentials and authentication keys, or moving a malicious file into an executable location.

For technical implementation details, see the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4347

Indicators of Compromise

• Unexpected file movements or missing critical files such as wp-config.php
• Unusual HTTP POST requests to form endpoints containing directory traversal patterns (e.g., ../)
• Web server logs showing form submissions with suspicious file path parameters
• New or modified files appearing in unexpected directories within the WordPress installation

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns targeting form submission endpoints
• Implement file integrity monitoring on critical WordPress files including wp-config.php, wp-settings.php, and core plugin files
• Deploy SentinelOne Singularity to detect anomalous file operations and process behaviors associated with WordPress exploitation
• Review access logs for unusual POST requests to mw-wp-form endpoints with encoded path characters

Monitoring Recommendations

• Enable verbose logging for the MW WP Form plugin to capture form submission details
• Configure alerting for file system changes to the WordPress root and wp-content directories
• Implement real-time monitoring of PHP process execution for suspicious file operations
• Use SentinelOne's behavioral AI to detect post-exploitation activities following successful file manipulation

How to Mitigate CVE-2026-4347

Immediate Actions Required

• Update MW WP Form plugin to a version newer than 5.1.0 when a patched version becomes available
• Temporarily disable file upload fields in MW WP Form configurations until patched
• Consider disabling the "Saving inquiry data in database" option to eliminate the prerequisite conditions
• Implement WAF rules to block requests containing directory traversal sequences targeting form endpoints
• Audit existing form configurations and remove unnecessary file upload capabilities

Patch Information

Organizations should monitor the WordPress Plugin Repository and the Wordfence Threat Intelligence page for official patch announcements. Until a patched version is released, implementing the recommended workarounds is critical for reducing exposure.

Workarounds

• Remove or disable file upload fields from all MW WP Form configurations
• Disable the "Saving inquiry data in database" option in form settings
• Implement server-level restrictions on the upload directories using .htaccess or nginx configuration
• Deploy application-layer protections that sanitize path parameters in form submissions
• Consider using an alternative form plugin until a security update is available

# Example .htaccess restriction for uploads directory
<Directory /var/www/html/wp-content/uploads>
    php_flag engine off
    Options -ExecCGI
    RemoveHandler .php .php3 .php4 .php5 .phtml
</Directory>