MW WP Form vulnerabilities
4 known vulnerabilities in MW WP Form from Inc2734. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter (upload field key) passed to the generate_user_file_dirpath() function, which
- 8.1 High severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This make
- 9.8 Critical severity
MW WP Form: Unrestricted Upload of File with Dangerous Type
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload a
- 9.8 Critical severity
MW WP Form: Improper Limitation of a Pathname to a Restricted Directory
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenti