Security researchers at Wordfence detailed a critical security flaw in the MW WP Form plugin, affecting versions 5.0.1 and earlier. The vulnerability allows unauthenticated threat actors to exploit the plugin by uploading arbitrary files, including potentially malicious PHP backdoors, with the ability to execute these files on the server.

MW WP Form Plugin

The MW WP Form plugin helps to simplify form creation on WordPress websites using a shortcode builder.

It makes it easy for users to create and customize forms with various fields and options.

The plugin has many features, including one that allows file uploads using the [mwform_file name=”file”] shortcode for the purpose of data collection. It is this specific feature that is exploitable in this vulnerability.

Unauthenticated Arbitrary File Upload Vulnerability

An Unauthenticated Arbitrary File Upload Vulnerability is a security issue that allows hackers to upload potentially harmful files to a website. Unauthenticated means that the attacker does not need to be registered with the website or need any kind of permission level that comes with a user permission level.

These kinds of vulnerabilities can lead to remote code execution, where the uploaded files are executed on the server, with the potential to allow the attackers to exploit the website and site visitors.

The Wordfence advisory noted that the plugin has a check for unexpected filetypes but that it doesn’t function as it should.

According to the security researchers:

“Unfortunately, although the file type check function works perfectly and returns false for dangerous file types, it throws a runtime exception in the try block if a disallowed file type is uploaded, which will be caught and handled by the catch block.

…even if the dangerous file type is checked and detected, it is only logged, while the function continues to run and the file is uploaded.

This means that attackers could upload arbitrary PHP files and then access those files to trigger their execution on the server, achieving remote code execution.”

There Are Conditions For A Successful Attack

The severity of this threat depends on the requirement that the “Saving inquiry data in database” option in the form settings is required to be enabled in order for this security gap to be exploited.

The security advisory notes that the vulnerability is rated critical with a score of 9.8 out of 10.

Actions To Take

Wordfence strongly advises users of the MW WP Form plugin to update their versions of the plugin.

The vulnerability is patched in the lutes version of the plugin, version 5.0.2.

The severity of the threat is particularly critical for users who have enabled the “Saving inquiry data in database” option in the form settings and that is compounded by the fact that no permission levels are needed to execute this attack.

Read the Wordfence advisory:

Update ASAP! Critical Unauthenticated Arbitrary File Upload in MW WP Form Allows Malicious Code Execution

Featured Image by Shutterstock/Alexander_P

SEOs catch flak for ruining the web, but they play a crucial role in the search ecosystem, and actually make the internet better for everyone.

Let’s get the criticism out of the way. There are bad actors in SEO, people who seek to extract money from the internet regardless of the cost to others. There are still scams and snake oil, posers and plagiarists. Many parts of the web have become extremely commercialized, with paid advertising and big brands displacing organic and user-generated content.

But while there are situations where SEOs have made things worse, to fixate on them is to ignore the colossal elephant in the room: in the ways that really matter, the web is the best it’s ever been:

• It’s the easiest it has ever been to find information on the internet. Searchers have a staggering array of tutorials, teardowns, and tips at their fingertips, containing information that is generally accurate and helpful—and this was not always the case.
• Bad actors have a smaller influence over search. Search is less of a Wild West than it used to be. Once-scam-ridden topics are subject to significant scrutiny, and the problems and loopholes in search that need fixing today—like big brands and generic content receiving undue prominence—are smaller and less painful than the problems of the past.
• More people use search to their benefit. Online content is the most accessible it has ever been, and it’s easier than ever to grow a local business or expand into international markets on the back of search.

SEOs have played a crucial role in these improvements, poking and prodding, building and—sometimes—breaking. They are Google power users: the people who push the system to extremes, but in doing so, catalyze the change needed to make search better for everyone.

Let’s explore how.

SEOs are much-needed intermediaries between Google and the rest of the world, helping non-technical people acquire and benefit from search engine traffic.

There is a huge amount of valuable information locked up in the heads of people who have no idea how to build a website or index a blog post. A carpet fitter with a bricks-and-mortar business might have decades of experience solving costly problems with uneven subfloors or poor moisture management, but no understanding of how to share that information online.

SEOs provide little nudges towards topics that people care about and writing that’s accessible to people and robots. They help solve technical problems that would hinder or completely block a site from appearing in search results. They identify opportunities for companies to be rewarded for creating great content.

It’s a win-win: businesses are rewarded with traffic, searchers have their intent satisfied, and the world is made a little richer for the newfound knowledge it contains.

SEOs do many things to actively make the web a better place, tending to their own plot of the Google garden to make sure it flourishes.

Take, for example, the myriad standards and guidelines designed to make the web a more accessible place for users. The implementation of these standards—turning theoretical guidelines into real, concrete parts of the web—often happens because of the SEO team.

Technical SEOs play a big part in adhering to the Web Content Accessibility Guidelines, a set of principles designed to ensure online content is “perceivable, operable, understandable, and robust” for every user. Every SEO’s fixation with Core Web Vitals fuels a faster, more efficient web. Content teams translate Google’s helpful content guidelines into useful words and images on a page.

(Case in point: check out Aleyda Solis’ Content Helpfulness Analyzer.)

There is a lot of overlap between “things that help users” and “things that improve search performance.” Even if the motive behind these changes is as simple as generating more traffic, a well-optimized website is, generally speaking, one that is also great for real human beings trying to engage with it.

The biggest criticism leveled at SEOs is that they break things. And they do! But that breakage acts as a type of pressure testing that strengthens the system as a whole.

Abuse of spintax and keyword stuffing forced Google to develop a better understanding of on-page content. Today, that loophole is closed, but more importantly, Google is much better at understanding the contents of a page and its relationship to a website as a whole.

Hacks like hiding keywords with white text on a white background (or moving them beyond the visible bounds of the screen) forced Google to expand its understanding of page styling and CSS, and how on-page information interacts with the environment that contains it.

Even today’s deluge of borderline-plagiarised AI content is not without benefit: it creates a very clear incentive for Google to get better at rewarding information gain and prioritizing publishers with solid EEAT credentials. These improvements will make tomorrow’s version of search much better.

This isn’t just Google fixing what SEOs broke: these changes usually leave lasting benefits that extend beyond any single spam tactic and make search better for all of its users.

This is not to argue that blackhat SEO is desirable. It would be better to make these improvements without incurring pain along the way. But Search is huge and complicated, and Google has little incentive to spend money proactively fixing problems and loopholes.

If we can’t solve every issue before it causes pain, we should be grateful for a correction mechanism that prevents it—and more extreme abuse—from happening in the future. SEOs break the system, and in doing so, make future breakages a lot less severe.

Some SEOs take advantage of the loopholes they discover—but many don’t. They choose to raise these issues in public spaces, encourage discussion, and seek out a fix, acting like a proxy quality assurance team.

At the small end of the spectrum, SEOs often flag bugs with Google systems, like a recent error in Search Console reporting flagged independently by three separate people, or Tom Anthony famously catching an oversight in Google’s Manual Actions database. While these types of problems don’t always impact the average user’s experience using Google, they help keep search systems working as intended.

At the other end of the scale, this feedback can extend as far as the overarching quality of the search experience, like AJ Kohn writing about Google’s propensity to reward big brands over small brands, or Lily Ray calling out an uptick in spam content in Google Discover.

SEOs are Google’s most passionate users. They interact with it at a scale far beyond the average user, and they can identify trends and changes at a macroscopic level. As a result, they are usually the first to discover problems—but also the people who hold Google to the highest standard. They are a crucial part of the feedback loop that fuels improvements.

SEOs act as a check-and-balance

Lastly, SEOs act as a check-and-balance, gathering firsthand evidence of how search systems operate, letting us differentiate between useful advice, snake oil, and Google’s PR bluster. 

Google shares lots of useful guidance, but it’s important to recognize the limits of their advice. They are a profit-seeking company, and Search requires opacity to work—if everyone understood how it worked, everyone would game it, and it would stop working. Mixed in with the good advice is a healthy portion of omission and misdirection.

Google Search plays a vital role in controlling the flow of the web’s information—it is simply too important for us to leave its mechanics, biases, and imperfections unexplored. We need people who can interrogate the systems just enough to separate fact from fiction and understand how the pieces fit together.

We need people like Mic King, and his insanely detailed write-up of SGE and RAG; Britney Muller and her demystification of LLMs; the late Bill Slawki’s unfaltering patent analysis; or our own Patrick Stox’s efforts in piecing together how search works.

Final thoughts

The web has problems. We can and should expect more from Google Search. But the problems we need to solve today are far less severe and painful than the problems that needed solving in the past; and the people who have the highest expectations, and will be most vocal in shaping that positive future, are—you guessed it—SEOs.

To SEOs: the cause of (and solution to) all of the web’s problems.

Lead magnets have long been an effective tactic for generating more leads and growing an email list.

Popular in the marketing industry, lead magnets can also be used by independent business owners to attract more clients and build online authority.

This is also true for law firms, which often rely on their content to build trust, increase traffic, and generate more leads.

However, law firms face unique challenges given the complexity of their subject matter and the restrictions regarding soliciting new clients.

That’s why we are sharing some of the most creative (and effective) lead magnet ideas law firms can use to grow their email lists and get more leads.

1. Educational Ebooks

The legal process can be confusing for many clients. They might venture to Google in search of resources, information, services, and tips for their case.

What better way to build your authority and draw in potential clients than to share educational content via ebooks?

Ebooks are generally in-depth guides or reports that cover a particular topic in detail. For law firms, ebooks can provide beginner-friendly insights, case studies, and/or step-by-step guidance regarding legal issues.

Not a designer? No problem! There are tons of free tools you can use to create ebooks. One of the most popular options is Canva.

Here’s how to create an ebook using Canva:

• Select a template: Canva offers a variety of ebook templates for different styles and themes. You can view and decide which pages to keep, discard, or edit to suit your needs.
• Customize the design: Use Canva’s stock photos, illustrations, icons, and graphics, or upload your own images to personalize your ebook. Experiment with colors, backgrounds, fonts, and photo effects.
• Add content: Fill in your design with helpful content. Add a descriptive title. Consider linking to supporting resources, including eye-catching images, adding “bonus tips,” and more to make your ebook engaging.
• Publish and share: Once the ebook is finalized, you can download and save it as a JPEG or PNG. Then, you can upload it to your website and put it behind a subscription wall.

2. Free Legal Templates

Templates are predesigned forms that make it easy for users to create, edit, and save their own documents. Templates can be used to create wills, lease agreements, contracts, non-disclosure agreements, parenting plans, and more.

As an attorney, you have the legal know-how to help clients create detailed and accurate legal documents.

While there are limitations – you should recommend users get their documents reviewed by an attorney – providing templates can help people head in the right direction.

When clients download the template, they can provide their email addresses, allowing your firm to follow up and offer to assist them in completing or reviewing the document.

Some other legal template ideas include:

• Power of attorney.
• Advance healthcare directives.
• Employment contracts.
• Business formation documents.
• Partnership agreements.
• Service agreements.
• Release or waiver forms.
• Prenuptial agreements.
• Intellectual property assignments.
• Demand letters.
• Cease and desist letters.
• Settlement agreements.
• Complaints or petitions.
• Loan agreements.
• Promissory notes.

3. Exclusive Webinars And Interviews

Live or pre-recorded webinars are another great way to offer value to potential clients. People love the interactive nature of live webinars and the ability to re-watch informational videos.

You can host online seminars, interviews, or sessions regarding important legal topics, helping your audience know what steps to take during the legal process.

For example, you can talk about how to navigate the divorce process, how to get started with a will, or what to know about real estate law.

Here are a few examples of titles you can use for your webinar:

• “Understanding Your Rights: [Legal Topic] Explained.”
• “Navigating [Legal Issue]: Your Step-by-Step Guide.”
• “Legal Essentials: How to Protect Your [Assets/Business/Family].”
• “How to Avoid Legal Pitfalls in [Scenario/Situation].”
• “[Legal Topic]: A Lawyer’s Tips for Success.”
• “Legal Questions Answered: [Topic] Q&A Session.”
• “What Every [Entrepreneur/Parent/Homeowner] Should Know About [Legal Topic].”
• “What Every [Person/Business Owner] Should Know About [Legal Topic].”

Once you have your idea for your webinar or interview, you can promote your session on social media, your website, or via your email list.

Then, people can register for the webinar by providing their contact information and expressing their interest in the topic.

This will allow you to follow up with them after the session, opening the door to them becoming new clients.

4. Downloadable Checklists

Simplify complex legal topics and processes with easy-to-follow checklists.

Checklists help prospective clients organize their tasks, prepare for their cases, and remember important details regarding legal proceedings.

Checklists provide a ton of value, making them a smart pick for a potential lead magnet.

Say, for example, that you’re a will and probate attorney. You could create a checklist titled “X-Step Checklist for Estate Planning.”

You could design this document to include helpful resources, tasks, and graphics that support people navigating the estate planning process.

Some steps on this type of checklist might include:

• Download our free Estate Plan Template.
• Create a list of your family members and other beneficiaries.
• Take inventory of your assets, such as real estate, bank accounts, and investments.
• Take inventory of your liabilities, such as debts, mortgages, and loans.
• Record the information from your insurance policies (life, health, and property).
• Choose your power of attorney designation.
• Hire a will and probate attorney to help you draft your last will and testament.
• Schedule for reviewing and updating the estate plan.

You can offer checklists as downloadable content in exchange for contact information, which will help you build a database of potential clients.

Plus, a necessary step in the checklist could be for someone to contact an attorney (i.e., you) for more support; you can then provide your direct contact information.

5. Actionable Worksheets

Similar to checklists, worksheets are interactive tools that help potential clients understand the legal process, assess their situation, prepare for a legal consultation, and even calculate estimated attorney costs.

Worksheets can be particularly helpful if you are used to getting new clients who don’t yet have their information or documents in order.

People can opt into using the worksheet, which provides value to them and makes them a better client for you!

You could even have people fill out the worksheets in exchange for personalized feedback or consultation offers, creating an opportunity for you to engage with them directly.

6. Tools And Resource Lists

If you have the technical skills to create web applications (or the resources to hire someone to do this for you), digital tools are a great way to garner user interest and generate leads.

Resource lists are perhaps the simplest version of this. You can design and publish a list of relevant resources someone might need and then host this list on your website.

For example, some resources might include document templates, links to government websites, links to case studies, and links to helpful videos.

Another approach is to create online tools such as calculators or apps. Some ideas include:

• As an interactive “checkup” tool that evaluates users’ legal needs.
• A cost calculator that estimates the costs for certain proceedings (like starting a business, filing for divorce, hiring an attorney, etc.) based on the user’s specifications.
• An e-document generator, which creates basic legal documents like non-disclosure agreements or letters of intent.
• Visual timeline “maps” that show the typical timeline of various legal processes.
• Case studies, where users can input different variables to see the possible legal outcomes for their situation.

There may be many more ideas that we haven’t been able to think of here, so get creative and consider what might be most relevant to your audience!

Remember that the key is to capture users’ information so you can follow up with them later as a possible lead.

7. Video Tutorials

Unlike webinars, video tutorials are usually pre-recorded videos in which you instruct users on a particular process from start to finish. This usually includes detailed steps and examples instead of interviews or sound bites.

Consider some scenarios in which clients might need help navigating a task, such as filing a small claims case or trademarking their logo.

Then, create an outline for your video, detailing the steps you want people to take.

Finally, record your video, edit the content, and then host the video – likely as a private video on YouTube (which can be sent to subscribers via email) or behind an opt-in wall on your website.

8. Legal Case Studies

Case studies are common lead magnets for the legal industry. This is because potential clients want to see examples of when you have succeeded in a case and what the outcome was for your client.

Case studies can build trust and convince people that you are the attorney to work with.

In your case study, explain the problem the client was facing, how the case was handled, what the outcome was, and (ideally) your client’s review of your services.

Highlight the benefits of your client working with an attorney to get the guidance and support they need to navigate this stressful and challenging situation.

You can put these case studies behind an opt-in wall or have them express interest via social media, with you sending them the case study in exchange for their email address.

Interested readers can then request more information or a consultation, becoming a potential lead!

9. Interactive Quizzes

Quizzes are usually used to prompt users to answer questions and receive a “score.”

But in their application to the legal field, quizzes can be used to help people assess their legal situation and receive answers, next steps, or considerations from a trusted legal professional.

These “answers” could be auto-generated based on certain criteria or (most effectively) crafted by your legal team and sent to the recipient via email.

The user receives their personalized assessment, with recommendations and/or precautions for their case, and you generate a potential new lead.

Keep in mind that there are limits to what degree you can provide legal counsel to someone who is not yet a client. Your “answers” might need to include more general advice and a recommendation to seek out legal counsel.

10. Mini-Courses

Similar to tutorials, courses can be used to help people understand their rights, learn how to navigate the legal process, or know the steps they need to take to hire an attorney.

A course does not necessarily need to be on video but could consist of an email series, downloadable PDF, or a series of worksheets.

Course hosting platforms like Teachable and Kajabi make it easy to publish your course materials, drive sign-ups, and even follow up with your subscribers.

You can publish mini course videos, add “homework,” link to related resources, and so much more.

Remember that creating a course is often more involved than just a single tutorial. That’s why we recommend creating a “mini” course that provides just enough value to get people interested in your services.

Here are some example course topics you could use:

• Legal Fundamentals: X Steps to Understanding Your Rights.
• Navigating Contracts: What You Need to Know Before Signing.
• Estate Planning Basics: How to Plan Your Legacy.
• Small Business Law: Protect Your Company the Right Way.
• Intellectual Property 101: How to Safeguard Your Ideas.
• Mini-Course: How to Buy and Sell Property (Tips From a Real Estate Attorney).
• Employment Law for Employees: Know Your Workplace Rights.

11. Trend Reports

Trends reports offer analysis, findings, and opinions regarding trending legal topics or stories.

If there’s a hot topic in your industry – and people are searching for it – it could be an interesting idea to publish your very own trends report.

For example, say you are a real estate attorney. A common trending topic is the real estate market: is it going up or down?

You could host a “market watch” report summarizing your findings and connecting the market to what buyers/sellers need to know about real estate law.

You can advertise your specialized report and grow your email list by enticing users to opt into your report or newsletter.

Then, you can notify your audience of special events, promotions, blog posts on your website, upcoming webinars, and so much more. That way, you have a growing list of potential leads!

12. Facebook Groups

People are constantly searching for information — on Google, on social media, and yes, even in Facebook Groups. If you have knowledge to share, creating a Facebook Group could be a way to generate more leads.

When you create a Facebook Group, you are able to prompt new members to answer questions when they sign up.

These can be questions like, “Why are you interested in [legal topic]?” “Would you like to provide your email address to receive more information?” or “What other topics are you interested in?”

These questions can help you not only grow your list but also come up with more topic ideas for your group.

For example, you could create a Facebook Group called “Real Estate Watch” if you are a real estate attorney, “Small Business Tips” as a business attorney, or “Contracts 101” as a contracts attorney.

While you can’t give out personalized legal advice, you can point people in the right direction if they have questions about complex legal matters.

Think Of Your Own Creative Lead Magnet Ideas

When it comes to lead generation, the possibilities aren’t only limited to this list!

You know your audience the best, so you might have your own ideas for how to engage with them and what content they might be interested in.

Don’t hesitate to think outside the box to come up with your own lead magnet ideas.

Lead magnets can be an effective tool for increasing engagement, growing your audience, and attracting new leads. Law firm marketing doesn’t have to be boring.

Try to think of new ways to reach your audience and get them excited to work with you.

More resources: 

Featured Image: Andrey_Popov/Shutterstock