CVE-2023-28408: 
WordPress vulnerability analysis and mitigation

Directory traversal vulnerability (CVE-2023-28408) affects MW WP Form versions v4.4.2 and earlier, allowing remote unauthenticated attackers to alter the website, cause denial-of-service (DoS) conditions, and obtain sensitive information depending on settings. The vulnerability was discovered by Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. and was publicly disclosed on May 15, 2023 (JVN Advisory).

The vulnerability is classified as a Path Traversal (CWE-22) issue where the plugin does not properly validate file paths. The severity is rated as CRITICAL with a CVSS v3.1 Base Score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability allows unauthenticated users to upload files to arbitrary locations on the system (WPScan).

The exploitation of this vulnerability can lead to multiple severe consequences: website alteration, denial-of-service conditions, and unauthorized access to sensitive information, depending on the system settings (JVN Advisory).

Users are advised to update to MW WP Form version 4.4.3 or later, which contains the fix for this vulnerability (JVN Advisory).