MW WP Form CVE-2026-78363

Exploitation requires two conditions to be simultaneously true: (1) the target WordPress site must be running MW WP Form plugin version earlier than 5.1.5, and (2) the site operator must have explicitly configured the plugin to echo a submitted form field value back to the visitor in the post-submission response - this is not the default behavior and must be deliberately enabled. No authentication is required (PR:N per CVSS vector), and the attacker needs only network access to the form submission endpoint. What limits exploitation: the non-default echo-back configuration is the hard gate - sites without this feature enabled are not exploitable regardless of plugin version. Additionally, the practical impact is bounded by which WordPress shortcodes happen to be registered on the specific target site; a site with only benign shortcodes faces minimal risk even if exploited.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N is well-calibrated for this vulnerability. The AC:H accurately captures the critical limiting factor: exploitation requires the site operator to have explicitly enabled the 'echo submitted value back to visitor' behavior - this is not a default configuration. Without this setting, the attack path does not exist regardless of plugin version. The PR:N reflects that no authentication is required once the condition is met. The C:L/I:L impact scoring is conservative and appropriate: the actual damage depends entirely on which shortcodes are registered on the target site - benign sites may expose only informational shortcodes, while sites with powerful plugins (e.g., shortcodes executing database queries, file operations, or user enumeration) face higher practical impact. A publicly available PoC via WPScan increases the ease of opportunistic exploitation against misconfigured instances. The vulnerability is not in CISA KEV, and the EPSS data is not provided. The combination of a gating non-default configuration and limited scope (S:U) keeps this a realistic but bounded risk. Defenders should prioritize patching sites where the echo-back feature is actively used.

An attacker identifies a WordPress site running MW WP Form with the post-submission echo feature enabled and submits a form field containing a malicious shortcode payload such as [some-registered-shortcode param='value']. The plugin merges this value into its message template and processes it through WordPress's shortcode engine, causing the shortcode to execute server-side. Depending on registered shortcodes, the attacker could extract site configuration data, trigger information disclosure of user records, or invoke functionality exposed by other installed plugins. A publicly available PoC from WPScan simplifies identification and exploitation of vulnerable, misconfigured sites.