What is the CVSS score of CVE-2026-6206?

CVE-2026-6206 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

MW WP Form CVE-2026-6206

EUVD-2026-30260 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 security@wordfence.com

GHSA-ppgv-g9ww-9w9w

Authentication Bypass Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 14, 2026 - 09:30 vuln.today

Analysis Generated

May 14, 2026 - 09:30 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

AnalysisAI

MW WP Form plugin for WordPress allows unauthenticated attackers to extract data from password-protected, private, and draft posts via the _get_post_property_from_querystring() function due to insufficient access control checks on post retrieval. The vulnerability affects all versions up to 5.1.2 and requires only network access with no user interaction, enabling confidential content disclosure to unauthorized users.

Technical ContextAI

The MW WP Form plugin uses the _get_post_property_from_querystring() function to retrieve post properties from query string parameters. The vulnerability exists because this function fails to properly validate post status and password-protection status before returning post data, violating WordPress's fundamental access control model where only published, publicly-accessible posts should be retrievable without authentication. The root cause is improper input validation (CWE-639: Authorization Bypass Through User-Controlled Key) combined with missing checks for post_status (publish vs. draft/private) and password_required() conditions. The fix adds explicit checks: if post_status is not 'publish' OR if the post requires a password, the function now returns early, preventing unauthorized access.

RemediationAI

Vendor-released patch available: upgrade MW WP Form to version 5.1.3 or later, which implements explicit post status and password protection checks in the _get_post_property_from_querystring() function. The fix adds validation that returns early if post_status is not 'publish' or if post_password_required() returns true. Users should update immediately via the WordPress admin plugin update interface or directly from the WordPress plugin repository. No workarounds are available short of disabling the form plugin entirely; the vulnerability is inherent to the plugin's design and cannot be mitigated at the web server or WordPress configuration level without removing the plugin. Monitor the Wordfence vulnerability database and WordPress plugin security advisories for any additional post-patch analysis.