Information Exposure Vulnerability in MW WP Form Plugin for WordPress
CVE-2026-6206

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Mw WP Form
Vendor
CVE Published:
14 May 2026

What is CVE-2026-6206?

The MW WP Form plugin for WordPress has a vulnerability allowing unauthorized data access. Specifically, through the _get_post_property_from_querystring() function, insufficient restrictions permit unauthenticated attackers to retrieve information from password-protected, private, or draft posts. This issue affects all versions up to 5.1.2, posing significant risks to sensitive data security.

Affected Version(s)

MW WP Form 0 <= 5.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/web-soudan/mw-wp-form/commit/77aed98f5...
https://plugins.trac.wordpress.org/changeset/3516013/mw-w...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kirasec
.