CVE-2023-6559
published 2023-12-16CVE-2023-6559: The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.31%
67.1th percentile
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inc2734 | mw_wp_form | <= 5.0.3 | — |
| web-soudan | mw_wp_form | < 5.0.4 | 5.0.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MW WP Form Plugin up to 5.0.3 on WordPress denial of service (ID 3007879)
vuldb·2026-04-11·CVSS 7.5
CVE-2023-6559 [HIGH] MW WP Form Plugin up to 5.0.3 on WordPress denial of service (ID 3007879)
A vulnerability was found in MW WP Form Plugin up to 5.0.3 on WordPress. It has been classified as problematic. This affects an unknown part. This manipulation causes denial of service.
The identification of this vulnerability is CVE-2023-6559. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
GHSA-gp3f-cq56-47mc: The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5
ghsa_unreviewed·2023-12-16
CVE-2023-6559 [HIGH] CWE-22 GHSA-gp3f-cq56-47mc: The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset/3007879/mw-wp-formhttps://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=cvehttps://plugins.trac.wordpress.org/changeset/3007879/mw-wp-formhttps://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=cve
2023-12-16
Published