CVE-2026-5436 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

🗓️ 08 Apr 2026 20:25:10Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Unauthenticated arbitrary file move in MW WP Form versions up to five point one point one via upload key, enabling file moves and possible remote code execution.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-5436	8 Apr 202620:25	–	attackerkb
Circl	CVE-2026-5436	8 Apr 202622:54	–	circl
CNNVD	WordPress plugin MW WP Form 路径遍历漏洞	8 Apr 202600:00	–	cnnvd
CVE	CVE-2026-5436	8 Apr 202620:25	–	cve
Cvelist	CVE-2026-5436 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys	8 Apr 202620:25	–	cvelist
EUVD	EUVD-2026-20643	8 Apr 202621:33	–	euvd
NVD	CVE-2026-5436	8 Apr 202621:17	–	nvd
Patchstack	WordPress MW WP Form plugin <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys vulnerability	10 Apr 202609:50	–	patchstack
Positive Technologies	PT-2026-31452	8 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-5436	11 Apr 202601:22	–	redhatcve

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.data.php
plugins	www.plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.1/classes/models/class.directory.php
plugins	www.plugins.trac.wordpress.org/changeset/3501261/mw-wp-form
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e95fe47b8
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5436.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-5436
github	www.github.com/web-soudan/mw-wp-form/commit/f872ab18ca670f5867b2241745daa30cd0fab861

08 Jul 2026 08:13Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.18.1

EPSS0.01069

MW WP Form arbitrary file move unauthenticated vulnerable versions upload files remote code execution form data saving