CVE-2026-5436: MW WP Form Path Traversal Vulnerability

CVE-2026-5436 Overview

The MW WP Form plugin for WordPress contains a critical Arbitrary File Move/Read vulnerability affecting all versions up to and including 5.1.1. This path traversal flaw stems from insufficient validation of the upload field key parameter passed to the generate_user_file_dirpath() function. By exploiting WordPress's path_join() behavior—which returns absolute paths unchanged and discards the intended base directory—unauthenticated attackers can manipulate file paths to move arbitrary files on the server.

The vulnerability is particularly dangerous as it can lead to remote code execution when critical files such as wp-config.php are relocated, potentially exposing database credentials and allowing complete site compromise.

Critical Impact

Unauthenticated attackers can move sensitive files like wp-config.php to publicly accessible directories, leading to full site compromise and potential remote code execution.

Affected Products

• MW WP Form plugin for WordPress versions up to and including 5.1.1

Discovery Timeline

• April 8, 2026 - CVE-2026-5436 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5436

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal) and allows unauthenticated attackers to move arbitrary files on the WordPress server. The exploitation chain involves multiple components within the MW WP Form plugin's file handling system.

The attack exploits a fundamental design flaw in how the plugin processes user-supplied upload field keys. When an attacker submits a crafted mwf_upload_files[] POST parameter containing an absolute path (such as /var/www/html/wp-config.php), the plugin's Data model loads this value via _set_request_valiables(). The key survives validation because the targeted file genuinely exists at the specified absolute path.

During form processing, the regenerate_upload_file_keys() function iterates over these keys and invokes generate_user_filepath() with the attacker-supplied key as the $name argument. The _get_attachments() method then processes these surviving keys and passes the resolved file path to move_temp_file_to_upload_dir(), which executes a rename() operation to relocate the file into the uploads folder.

Root Cause

The root cause lies in the insufficient validation of the $name parameter within the generate_user_file_dirpath() function. This function relies on WordPress's path_join() utility, which has an important behavior: when provided with an absolute path as the second argument, it returns that absolute path unchanged, completely ignoring the intended base directory.

This behavior is documented in the WordPress codebase but represents a dangerous assumption when user-controlled input is passed directly to the function without sanitization. The plugin fails to implement proper path canonicalization or restrict input to relative paths only, allowing attackers to specify arbitrary file system locations.

Attack Vector

The attack is network-accessible and requires no authentication, though it has specific preconditions: the target form must have a file upload field configured, and the "Saving inquiry data in database" option must be enabled.

The attacker crafts a malicious form submission with the mwf_upload_files[] parameter containing absolute paths to sensitive files. When the form processes this submission, the vulnerable code path executes the file move operation, relocating the targeted file to the WordPress uploads directory where it may become publicly accessible or cause application malfunction.

For technical implementation details, refer to the WordPress Plugin Code Reference for class.data.php and class.directory.php.

Detection Methods for CVE-2026-5436

Indicators of Compromise

• Unexpected changes to critical WordPress files such as wp-config.php missing from expected locations
• Sensitive configuration files appearing in the /wp-content/uploads/ directory
• Web server error logs showing file not found errors for core WordPress files
• Unusual POST requests to MW WP Form endpoints containing absolute file paths in mwf_upload_files[] parameters

Detection Strategies

• Monitor web server access logs for POST requests containing suspicious path traversal patterns (absolute paths or ../ sequences) in form submission parameters
• Implement file integrity monitoring on critical WordPress files including wp-config.php, .htaccess, and core PHP files
• Deploy Web Application Firewall (WAF) rules to detect and block requests containing absolute file paths in form data
• Review WordPress uploads directory for files that should not exist there, particularly configuration files

Monitoring Recommendations

• Enable comprehensive logging for form submission activities within the MW WP Form plugin
• Configure real-time alerts for file system changes to WordPress core files and configuration files
• Implement baseline monitoring for the WordPress installation directory structure to detect unexpected file relocations
• Deploy SentinelOne Singularity for WordPress server endpoints to detect and prevent exploitation attempts through behavioral analysis

How to Mitigate CVE-2026-5436

Immediate Actions Required

• Update MW WP Form plugin to the latest patched version immediately
• Audit WordPress uploads directory for any misplaced sensitive files and restore them to proper locations
• Review web server logs for any evidence of exploitation attempts
• Temporarily disable file upload fields in MW WP Form until the update is applied
• If exploitation is suspected, regenerate WordPress security keys and database credentials

Patch Information

A security patch has been released to address this vulnerability. The fix implements proper path validation to prevent absolute paths from bypassing the intended upload directory restrictions. Details of the patch can be found in the GitHub commit and the WordPress Plugin Changeset.

For additional vulnerability details, see the Wordfence Vulnerability Report.

Workarounds

• Disable the "Saving inquiry data in database" option in MW WP Form settings to prevent the vulnerable code path from executing
• Remove file upload fields from forms until the plugin can be updated
• Implement server-level restrictions using .htaccess or nginx configuration to limit file operations within the uploads directory
• Deploy a Web Application Firewall with rules to block requests containing absolute paths in POST parameters

# Example .htaccess rules to restrict file access in uploads directory
# Add to wp-content/uploads/.htaccess

# Deny access to PHP files in uploads
<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Deny access to sensitive file types that should not be in uploads
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|sql)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>