MW WP Form CVE-2026-78364

Exploitation requires an authenticated WordPress user account with the Editor role or higher - unauthenticated attackers cannot exploit this vulnerability. An administrator must subsequently visit the admin dashboard page where the tainted form settings are rendered, making UI:R a hard prerequisite. The vulnerability is limited to WordPress installations running MW WP Form below version 5.1.6. No non-default configuration or unusual deployment mode is required beyond having the plugin installed and at least one Editor-role account existing. The key limiting factor is the Editor-role prerequisite: the attack surface is restricted to insider or account-compromise scenarios rather than external unauthenticated exploitation.

The aggregate signal picture here is notably split. The CVSS base score of 3.5 (Low) reflects real constraints: network-accessible (AV:N), but requiring at minimum high privilege (PR:H per the vector), user interaction from an admin (UI:R), and producing only limited confidentiality and integrity impact with no availability effect. However, the description explicitly states exploitation is possible by users 'as low as Editor', which in WordPress is a role that is privileged but meaningfully below admin - this suggests the PR:H designation may understate exploitability and the true required privilege is closer to PR:L. This CVSS vector discrepancy should be verified against the vendor's advisory. EPSS at 0.15% confirms low automated exploitation interest. A public POC from WPScan elevates practical risk above what EPSS alone implies, since scripted opportunistic targeting of WordPress sites is common. The vulnerability is not in the CISA KEV catalog. Realistically, this is a meaningful internal threat (rogue or compromised Editor-role accounts attacking admins via session hijacking or credential theft), but not a high-priority external attack surface. Organizations relying heavily on least-privilege separation between editor and admin roles should treat the patch as a routine maintenance priority.

An attacker with an Editor account (legitimately assigned or compromised) navigates to the MW WP Form plugin settings page in the WordPress admin area and injects a JavaScript payload into a form configuration field. The payload is stored server-side without sanitization. When an administrator subsequently loads the affected dashboard page, the stored script executes in their browser session, enabling session cookie theft, admin-level action forgery, or account takeover. A public PoC from WPScan confirms this attack path is documented and reproducible.