Path Traversal in Inc2734 Mw Wp Form
CVE-2026-5436
The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter (upload field key) passed to the generate_user_file_dirp…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.001 (34.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Inc2734 Mw Wp Form — versions 0
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e9…
- plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.d…
- plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.d…
- plugins.trac.wordpress.org/changeset/3501261/mw-wp-form
- github.com/web-soudan/mw-wp-form/commit/f872ab18ca670f5867b2241745daa30cd0fab861
Frequently asked questions
- What is CVE-2026-5436?
- CVE-2026-5436 is a high-severity vulnerability in Inc2734 Mw Wp Form, classified under Path Traversal. CVSS score: 8.1/10. Published 2026-04-08.
- How severe is CVE-2026-5436?
- High severity. CVSS v3 base score is 8.1 out of 10.