The MW WP Form plugin for WordPress contains a critical path traversal vulnerability that allows unauthenticated attackers to move arbitrary files on the server, creating a high risk of remote code execution.

The plugin fails to perform sufficient path validation within the generate_user_filepath and move_temp_file_to_upload_dir functions. An unauthenticated attacker can exploit this flaw to relocate sensitive system files, provided the site has a form with an active file upload field and the database saving option enabled.

Successful exploitation of this vulnerability can result in full system compromise. By moving critical files such as wp-config.php, an attacker can gain unauthorized access to sensitive data or execute arbitrary code on the underlying server. Given the CVSS score of 8.1, this represents a high-severity threat that could lead to complete service disruption and significant data breach incidents.

Immediate Action: There is currently no confirmed patch available; immediately deactivate and remove the MW WP Form plugin from your WordPress environment until a secure version is released.

Proactive Monitoring: Review web server access logs for unusual requests targeting the plugin directory or attempts to access configuration files from external sources.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious path traversal patterns, although complete removal of the plugin remains the only definitive mitigation.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the lack of a verified patch, necessitates an immediate response. Organizations should prioritize the removal of the MW WP Form plugin to eliminate the attack vector entirely. Security teams must monitor the vendor advisory for updates and verify the integrity of the WordPress installation if the plugin was previously in use.