Access violation vulnerability in MW WP Form 5.0.3

The MW WP Form plugin for WordPress is vulnerable to a security issue in all versions up to and including 5.0.3. Attackers who are not authorised to access the site could delete any file, including the wp-config.php file, which can give them control over the site and allow them to run code remotely. This vulnerability exists because the plugin does not check where a file is from before deleting it.