CVE-2023-6316 is a Critical severity (CVSS 9.8) arbitrary file upload flaw in the MW WP Form plugin for WordPress, in versions up to and including 5.0.1. Unauthenticated attackers could upload files that may lead to remote code execution. Update past 5.0.1 and inspect uploaded files.
What's affected
The NVD description sets the range.
- Affected: MW WP Form versions up to and including 5.0.1.
- Fixed: the record does not name a fixed version. It links the plugin's changeset 3003065, which is the code change that addressed the issue. I could not read the changeset or the Wordfence entry, so confirm the fixed release on the plugin's page. Updating to the current release is the safe course.
- Severity: 9.8 Critical. No login is needed.
- Location: the
_single_file_uploadfunction, where file type validation was insufficient.
The weakness is CWE-434, unrestricted upload of a dangerous file type. The record's kev flag is false.
How to check if you're exposed
Check the version on each site.
wp plugin list --fields=name,status,version | grep mw-wp-form
wp plugin update mw-wp-form
Then check for unexpected files. Look in the uploads directory for script files, which should never be there.
find wp-content/uploads -type f ( -name "*.php" -o -name "*.phtml" -o -name "*.phar" )
Also look at the web server logs for POST requests to pages that host the form, from addresses outside your normal traffic, and for later requests to files in the uploads folder with script extensions.
What to do now
- Update MW WP Form to the current release and confirm the version is above 5.0.1.
- Search the uploads directory and web root for script files that you did not create, and preserve a copy before removing any.
- If you find one, treat the site as compromised: rotate WordPress salts, database and administrator credentials, and restore from a known good backup.
- Block PHP execution in the uploads directory at the web server, so a stray upload cannot run.
- Remove the plugin if no forms use it, and keep forms that take file uploads to a minimum.
Why it matters
A form plugin that accepts files has to validate the type of every upload on the server. Browser side checks and extension lists in a form's settings do not count, because an attacker can send a request directly. The description says the check in this function was insufficient, and the form handler is reachable without logging in.
The path from upload to code execution is short on a typical PHP host. A script file placed in a web served folder runs when someone requests it. That explains the 9.8 score, which assumes network access, no privileges and no user interaction. Hardening that stops script execution in uploads breaks the last step. The sources do not report exploitation in the wild.
Quick check
Which version fixes CVE-2023-6316?
The record does not name it. Update to the current release and confirm the version is above 5.0.1.
Can I rely on form settings that restrict file types?
No. The server must enforce the type check, because a direct request skips the form.
Sources
- Plugin changeset 3003065 (listed in the record, not readable when fetched)
- Wordfence entry (listed in the record, not readable when fetched)
Last reviewed: 19 October 2026.
