CVE-2023-6559
📋 TL;DR
The MW WP Form WordPress plugin has a vulnerability allowing unauthenticated attackers to delete arbitrary files on the server, including critical WordPress files like wp-config.php. This affects all versions up to 5.0.3. Successful exploitation could lead to complete site takeover and remote code execution.
💻 Affected Systems
- MW WP Form WordPress Plugin
📦 What is this software?
Mw Wp Form by Web Soudan
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise via wp-config.php deletion leading to database takeover, followed by remote code execution and potential server compromise.
Likely Case
Site defacement, data loss from deleted files, and service disruption requiring restoration from backups.
If Mitigated
Limited impact with proper file permissions and monitoring, potentially only non-critical file deletion.
🎯 Exploit Status
Simple path traversal attack with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.4
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3007879/mw-wp-form
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MW WP Form and click 'Update Now'. 4. Verify version is 5.0.4 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate mw-wp-form
File Permission Hardening
linuxSet restrictive permissions on critical WordPress files.
chmod 400 wp-config.php
chmod 400 wp-config-sample.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal attempts
- Disable file upload functionality in the plugin settings if possible
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → MW WP Form version. If version ≤5.0.3, vulnerable.Check Version:
wp plugin get mw-wp-form --field=versionVerify Fix Applied:
Verify plugin version is 5.0.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/mw-wp-form/ with path traversal patterns
- File deletion events in wp-content/uploads/mw-wp-form/ directory
Network Indicators:
- POST requests containing '../' sequences to MW WP Form endpoints
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/mw-wp-form/*" AND (payload="../" OR payload="..\\")🔗 References
- https://plugins.trac.wordpress.org/changeset/3007879/mw-wp-form
- https://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=cve
- https://plugins.trac.wordpress.org/changeset/3007879/mw-wp-form
- https://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=cve
