Skip to content
OpenAdvisories

Vendor

inc2734

10 known vulnerabilities.

Products

MW WP Form 4 Smart Custom Fields 3 Snow Monkey Blocks 1 Snow Monkey 1 Snow Monkey Forms 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-5436

    MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

    The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter (upload field key) passed to the generate_user_file_dirpath() function, whic…

    inc2734 MW WP Form Web / CMS
  • High 8.1
    CVE-2026-4347

    MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

    The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This mak…

    inc2734 MW WP Form Web / CMS
  • High 7.5
    CVE-2023-6559

    MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion

    The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthent…

    inc2734 MW WP Form Web / CMS