MW WP Form

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 49% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ theguysnews

   5mo ago

   WARNING – This plug-in has an Arbitrary File Move vulnerability in MW WP Form, a WordPress plugin with more than 200,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to move arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. UPDATE: 08 April 2026 07H27 (GMT+2)The author has released versions 5.1.1 and 5.1.2 to address the Arbitrary File Move vulnerability (CVE-2026-4347). While the initial communication was difficult, I appreciate the prompt release of the security fixes. Users should update immediately to ensure their sites are protected. This topic was modified 3 months, 2 weeks ago by theguysnews. This topic was modified 3 months, 1 week ago by theguysnews.

   Read on wp.org ↗
2. ★★★★★ seaj1one

   2.9y ago

   You can’t delete the plugin if you don’t want it.

   Read on wp.org ↗
3. ★★★★★ rei15

   5.6y ago

   プラグイン画面もエラーメッセージも英語になってしまい、新バージョンだと、もともとからあった日本語ファイルが消えてたそうですが、なぜ消えたのかわかりません。。 以下2つのファイル復活させる方法ないでしょうか？ /wp-content/language/plugins/mw-wp-form-ja.mo /wp-content/language/plugins/mw-wp-form-ja.po

   Read on wp.org ↗
4. ★★★★★ ikaneko

   7.9y ago

   配列の初期化に[]を利用しているので、 PHHP5.3で利用できなくなったようです。 PHPのバージョンチェックしてほしい。

   Read on wp.org ↗
5. ★★★★★ ichaing

   8.0y ago

   先に投稿されている方もいらっしゃいますが、私も4.0.3にアップデートしたらページから管理画面から全てエラーになりました。 サーバーからプラグインを削除し、古いバージョンを入れなおすと改善できます。

   Read on wp.org ↗
6. ★★★★★ shinzo35

   8.0y ago

   私の環境では4.0.3アップデート後にエラーが出ました。 ログを確認したところclass.main.phpの中の [ が原因のようでした。 4.0.2に戻しましたが、ほかの方はどうでしょう？

   Read on wp.org ↗
7. ★★★★★ childsview

   8.0y ago

   Very useful form. We installed this plugin over hundred for client sites.

   Read on wp.org ↗
8. ★★★★★ Yutaro Ikeda

   8.1y ago

   Easy to use & simple setting. Thanks for this plugin!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.1.4 Security Tighten output escaping on inquiry data detail screen 5.1.4
2. — Version 5.1.3 Security Tighten access control on post property reference handling Added Cookie SameSite=Lax attribute to CSRF / session cookies Added Admin notice for [mwform_file] / [mwform_image] shortcodes, which are scheduled for 5.1.3
3. — Version 5.1.2 Security Fix insufficient file path validation in upload file handling 5.1.2
4. — Version 5.1.1 Security Fix insufficient file path validation in upload file handling 5.1.1
5. — Version 5.1.0 Security Use wp_kses_post to form content/complete message 5.1.0
6. — Version 5.0.6 Fixed Fixed an error during uninstallation. ( later 5.0.0 ) Temporarily Removed PHP requirements 5.0.6

10 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.4 MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter ↗
   2026-06-09 CVE-2026-8853 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.3 Patched in 5.1.4
2. High · 7.2 MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-01 CVE-2026-48871 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.3 Patched in 5.1.4
3. Medium · 5.3 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter ↗
   2026-05-13 CVE-2026-6206 Authorization Bypass Through User-Controlled Key Affects <= 5.1.2 Patched in 5.1.3
4. High · 8.1 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys ↗
   2026-04-08 CVE-2026-5436 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.1.1 Patched in 5.1.2
5. High · 8.1 MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir ↗
   2026-04-01 CVE-2026-4347 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.1.0 Patched in 5.1.1
6. Medium · 5.5 MW WP Form <= 5.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
   2024-01-31 CVE-2024-24804 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.0.6 Patched in 5.1.0
7. High · 7.5 MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion ↗
   2023-12-15 CVE-2023-6559 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.0.3 Patched in 5.0.4
8. Critical · 9.8 MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload ↗
   2023-12-04 CVE-2023-6316 Unrestricted Upload of File with Dangerous Type Affects <= 5.0.1 Patched in 5.0.2
9. Medium · 5.3 MW WP Form <= 4.4.5 - Missing Authorization ↗
   2023-10-19 CVE-2023-46206 Missing Authorization Affects <= 4.4.5 Patched in 5.0.0
10. Medium · 5.3 MW WP Form <= 4.4.2 - Directory Traversal via _file_upload ↗
    2023-05-08 CVE-2023-28409 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 4.4.3 Patched in 4.4.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 70 languages, 6 at 90% or more

Plus 46 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• reCAPTCHA for MW WP Form 30K+ installs · 3.9★ · 2 shared tags D
• W Wufoo Shortcode 10K+ installs · 4.0★ · 2 shared tags D
• Shortcode Preview Block 1K+ installs · 3.9★ · 2 shared tags D
• Comments Shortcode 900+ installs · 4.2★ · 2 shared tags C
• MC4WP: Mailchimp for WordPress 1M+ installs · 4.8★ · 1 shared tag A
• Flamingo 800K+ installs · 4.2★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for MW WP Form into a readme, a review or a deck. It updates itself.

MW WP Form: 200K+ active installs, 4.2★ (23 reviews). Plugin Pulse (WP Mayor), as of 2026-08-26. https://plugins.wpmayor.com/plugin/mw-wp-form