CVE-2026-4347 is a path traversal vulnerability (CWE-22) in the MW WP Form plugin for WordPress affecting all versions up to 5.1.0. The issue arises from insufficient validation in the 'generate_user_filepath' and 'move_temp_file_to_upload_dir' functions, enabling unauthenticated attackers to move arbitrary files on the server. Exploitation requires that a file upload field is added to the form and that the 'Saving inquiry data in database' option is enabled. Successful exploitation can lead to remote code execution by relocating sensitive files such as wp-config.php. The CVSS v3.1 base score is 8.1, indicating a high severity vulnerability with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows unauthenticated attackers to move arbitrary files on the affected server, which can lead to remote code execution if critical files are moved. This compromises confidentiality, integrity, and availability of the affected system. The impact is high as it can result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or advisories are provided, users should monitor official inc2734 or WordPress plugin channels for updates. In the meantime, avoid enabling file upload fields combined with the 'Saving inquiry data in database' option in MW WP Form to reduce exposure.