Form plugin file move flaw risks site takeover
The MW WP Form plugin had an arbitrary file move flaw that let unauthenticated attackers move files such as wp-config.php, risking site takeover.
1 public report · first reported 2 April 2026 · last reported 2 April 2026
What's going wrong
Site owners using this WordPress form plugin, which has over 200,000 installs, report an arbitrary file move flaw. Unauthenticated attackers could move files such as the wp-config file, potentially enabling full site takeover. The flaw is tracked as CVE-2026-4347 and was patched in later releases, but many sites may stay exposed until owners update. One reviewer also said the initial vendor response was slow and difficult. The opportunity is a service that watches installed plugins for known vulnerabilities, alerts owners quickly, and applies fixes on their behalf.
AI-assisted: written with the help of AI from the reports.
Products affected
MW WP Form.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.