Inc2734 vulnerabilities
We track 5 vulnerabilities in Inc2734 products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 8, 2026.
Latest Inc2734 vulnerabilities
- 8.1 High severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter (upload field key) passed to the generate_user_file_dirpath() function, which
- 8.1 High severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This make
- 9.8 Critical severity
Snow Monkey Forms: Improper Limitation of a Pathname to a Restricted Directory
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attack
- 9.8 Critical severity
MW WP Form: Unrestricted Upload of File with Dangerous Type
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload a
- 9.8 Critical severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenti