A critical path traversal vulnerability in the MW WP Form plugin for WordPress allows unauthenticated attackers to manipulate server files, posing a severe risk of remote code execution.

This vulnerability is a path traversal flaw (CWE-22) triggered by insufficient validation of the upload field key parameter. Unauthenticated attackers can inject malicious paths via the mwf_upload_files POST parameter to move or read arbitrary system files.

The ability to move or read arbitrary files on a web server represents a critical security failure. An attacker could potentially exfiltrate sensitive configuration files, such as wp-config.php, or manipulate application files to achieve remote code execution, leading to complete site compromise and data loss. With a CVSS score of 8.1, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized system access.

Immediate Action: There is no official patch version listed; users should immediately deactivate and remove the MW WP Form plugin from all WordPress installations until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at form processing endpoints and monitor the filesystem for unauthorized file modifications or unexpected file movements within the uploads directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to block directory traversal patterns and restrict access to sensitive file paths, although these measures should be considered temporary until the plugin is removed or updated.

Public Exploit Available: Unknown

Given the potential for remote code execution and the unauthenticated nature of this attack vector, this vulnerability poses a significant risk to organizational assets. Administrators must prioritize the immediate removal of the affected plugin to eliminate the attack surface. Monitor environments closely for any indicators of compromise while evaluating alternative form solutions that maintain current security standards.