CVE-2026-4347: MW WP Form WordPress Plugin RCE Vulnerability

CVE-2026-4347 Overview

CVE-2026-4347 is a path traversal vulnerability [CWE-22] in the MW WP Form plugin for WordPress. The flaw affects all versions up to and including 5.1.0. Unauthenticated attackers can move arbitrary files on the server by abusing insufficient file path validation in the generate_user_filepath and move_temp_file_to_upload_dir functions. Moving sensitive files such as wp-config.php can lead to remote code execution. Exploitation requires the form to include a file upload field and the "Saving inquiry data in database" option to be enabled.

Critical Impact
Unauthenticated attackers can relocate arbitrary server files, including wp-config.php, enabling remote code execution on affected WordPress sites.

Affected Products

MW WP Form plugin for WordPress, all versions up to and including 5.1.0
WordPress sites with file upload field configured in MW WP Form
WordPress sites with the "Saving inquiry data in database" option enabled in MW WP Form

Discovery Timeline

2026-04-02 - CVE-2026-4347 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-4347

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied file path components within the MW WP Form plugin. The plugin processes uploaded files through the generate_user_filepath function in class.directory.php and the move_temp_file_to_upload_dir function in class.main.php. Neither function adequately sanitizes path components before performing filesystem operations. Attackers can therefore supply traversal sequences that cause the plugin to move files outside the intended upload directory.

Because the affected request flow is reachable without authentication, any visitor able to submit the form can trigger the file move. The downstream impact depends on what file is moved. Relocating wp-config.php exposes database credentials and authentication keys, while moving or replacing PHP files in writable paths can yield remote code execution.

Root Cause

The root cause is insufficient file path validation [CWE-22] in two cooperating functions. User-controllable input flows into filesystem move operations without canonicalization or allow-list checks. As a result, traversal sequences and absolute path manipulation reach rename-style operations on the host filesystem.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. Two preconditions must hold: the targeted form must contain a file upload field, and the "Saving inquiry data in database" option must be enabled. The attacker submits a crafted form request that influences the destination path used by move_temp_file_to_upload_dir, causing the plugin to relocate a file to an attacker-chosen location.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the affected source in class.main.php and class.directory.php for technical details.

Detection Methods for CVE-2026-4347

Indicators of Compromise

Unexpected POST requests to MW WP Form endpoints containing path traversal sequences such as ../ or absolute paths in upload-related parameters.
Modification or relocation of sensitive WordPress files including wp-config.php, .htaccess, or files under wp-content/.
Presence of new PHP files in writable directories that were not deployed by an administrator.
Anomalous filesystem rename events originating from the PHP-FPM or web server process tied to MW WP Form request handling.

Detection Strategies

Monitor web server access logs for MW WP Form form submissions containing encoded traversal patterns in file or filename parameters.
Compare filesystem state of WordPress core files against known-good baselines, alerting on changes to wp-config.php and other root files.
Inspect MW WP Form inquiry database records for entries referencing file paths outside the expected upload directory.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress root, wp-admin, wp-includes, and wp-content/uploads.
Forward web server and PHP error logs to a central analytics platform and alert on filesystem errors generated by MW WP Form classes.
Track outbound requests originating from the web server to detect post-exploitation callbacks.

How to Mitigate CVE-2026-4347

Immediate Actions Required

Update the MW WP Form plugin to a version newer than 5.1.0 as soon as a patched release is available from the vendor.
If no patched version is available, deactivate and remove the MW WP Form plugin from affected WordPress installations.
Disable the "Saving inquiry data in database" option on any form using a file upload field to remove the precondition required for exploitation.
Audit the WordPress filesystem for unauthorized file moves or new PHP files placed outside expected directories.

Patch Information

No fixed version is referenced in the current advisory data. Refer to the Wordfence Vulnerability Report and the plugin's WordPress.org page for patched release announcements.

Workarounds

Remove file upload fields from MW WP Form forms until a patch is applied.
Disable the "Saving inquiry data in database" option for all forms that include uploads.
Restrict access to MW WP Form submission endpoints using a Web Application Firewall rule that blocks requests containing ../ sequences in file-related parameters.
Enforce least-privilege filesystem permissions so the web server user cannot write to or rename WordPress core files such as wp-config.php.

bash

# Example: restrict write access to wp-config.php
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php