The MW WP Form plugin suffers from a path traversal vulnerability due to improper validation of the $name parameter in the generate_user_file_dirpath() function. The plugin uses WordPress's path_join() function, which returns absolute paths unchanged, allowing attacker-controlled input via the mwf_upload_files[] POST parameter to specify arbitrary absolute file paths. During form processing, these paths are used to move files into the uploads directory without sufficient checks, enabling arbitrary file move/read operations. This vulnerability can be exploited by unauthenticated attackers if a file upload field is present and inquiry data saving is enabled, potentially leading to remote code execution.

An unauthenticated attacker can move arbitrary files on the server, including sensitive files like wp-config.php, into the uploads directory. This can lead to remote code execution, complete compromise of the WordPress site, and potential further server compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling file upload fields in forms combined with the 'Saving inquiry data in database' option in MW WP Form. Monitor vendor channels for updates and apply patches promptly once released.