Mw Wp Form Project

mw_wp_form_project

3 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-6316 1Mw Wp Form Project 1Mw Wp Form Jun 17, 2026 Jan 11, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible f...Show more The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less
CVE-2023-28409 1Mw Wp Form Project 1Mw Wp Form Jun 17, 2026 May 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.
CVE-2023-28408 1Mw Wp Form Project 1Mw Wp Form Jun 17, 2026 May 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information dep...Show more Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.Show less