Skip to content
Threat Feed
Subscribe

Vendor

MW WP Form

1 brief RSS
critical advisory

MW WP Form WordPress Plugin Arbitrary File Move/Read Vulnerability (CVE-2026-5436)

The MW WP Form plugin for WordPress is vulnerable to arbitrary file move/read (CVE-2026-5436) due to insufficient validation of the $name parameter, allowing unauthenticated attackers to move arbitrary files, potentially leading to remote code execution.

MW WP Form plugin wordpress file-move rce
2r 2t 1c