CVE-2023-6316

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
inc2734	MW WP Form	<= 5.0.1

References

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63179.8A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account CVE-2023-63187.2A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS versio CVE-2023-63197.2A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS v CVE-2023-63207.2A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and CVE-2023-63218.8A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as CVE-2023-63228.8A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and CVE-2023-63236.5ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.CVE-2023-63248.8ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity CVE-2023-63255.3The RomethemeForm For Elementor plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabili CVE-2023-63264.3The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl CVE-2023-63275.3The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t CVE-2023-63299.8An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordC