CVE-2026-6206: MW WP Form Information Disclosure Flaw

CVE-2026-6206 Overview

CVE-2026-6206 is an Information Exposure vulnerability affecting the MW WP Form plugin for WordPress. The flaw exists in all versions up to and including 5.1.2. The vulnerability resides in the _get_post_property_from_querystring() function, which fails to enforce sufficient restrictions on which posts can be referenced through query string parameters. Unauthenticated attackers can leverage this weakness to extract content from password-protected, private, or draft posts. The issue maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Unauthenticated remote attackers can disclose protected, private, and draft post content without any user interaction.

Affected Products

• MW WP Form plugin for WordPress, all versions up to and including 5.1.2
• WordPress sites using the vulnerable plugin to render forms tied to post context
• Multisite WordPress installations with MW WP Form activated on any site

Discovery Timeline

• 2026-05-14 - CVE-2026-6206 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-6206

Vulnerability Analysis

The MW WP Form plugin exposes form-related post data via the _get_post_property_from_querystring() function. This function reads a post identifier from the request query string and returns properties of the referenced post. The function does not verify the post status or the requester's permission to view the post. As a result, supplying the identifier of a password-protected, private, or draft post causes the plugin to return data the requester is not authorized to read. The attack requires no authentication and no user interaction, and it can be carried out remotely over the network.

Root Cause

The root cause is a missing authorization check on a user-controlled key, classified as [CWE-639]. The _get_post_property_from_querystring() function trusts the post ID provided in the query string and returns post properties without confirming that the post is publicly viewable or that the caller has the required capability. This pattern is sometimes called Insecure Direct Object Reference. The fix landed in the plugin source tree and can be reviewed in the GitHub commit for mw-wp-form and the corresponding WordPress Plugin Changeset.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to a WordPress page that invokes MW WP Form, supplying the numeric ID of a non-public post in the query string. The plugin then echoes properties of the referenced post back into the response. Attackers can iterate post IDs to enumerate and harvest non-public content at scale. Refer to the Wordfence Vulnerability Analysis for additional technical context. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-6206

Indicators of Compromise

• Repeated unauthenticated requests to pages that render MW WP Form with varying numeric post ID parameters in the query string
• HTTP responses containing fragments of post content for posts whose status is private, draft, or password-protected
• Access log patterns showing sequential post ID enumeration from a single source IP or user agent

Detection Strategies

• Inspect web server access logs for high-volume query string requests targeting pages that embed MW WP Form shortcodes
• Correlate WordPress database post_status values with content returned in responses to identify unauthorized disclosure
• Deploy WordPress security plugin signatures that flag known MW WP Form vulnerability patterns referenced in the Wordfence advisory

Monitoring Recommendations

• Alert on anomalous enumeration of post or p query parameters against pages containing MW WP Form
• Track outbound response sizes for MW WP Form endpoints to detect unexpected data exposure
• Monitor the WordPress plugin inventory for installations running MW WP Form versions at or below 5.1.2

How to Mitigate CVE-2026-6206

Immediate Actions Required

• Update the MW WP Form plugin to a version newer than 5.1.2 that includes the fix from changeset 3516013
• Audit private, draft, and password-protected posts for evidence of unauthorized access in web server logs
• Restrict access to the WordPress site at the network edge while patching, if exposure cannot be eliminated quickly

Patch Information

The vendor remediated the issue by adding authorization checks within the _get_post_property_from_querystring() function. The patch is published in the GitHub commit for mw-wp-form and distributed via the WordPress Plugin Changeset 3516013. Administrators should install the fixed release through the WordPress admin Plugins screen or via WP-CLI.

Workarounds

• Deactivate the MW WP Form plugin until the patched version is deployed
• Use a Web Application Firewall rule to block requests to MW WP Form pages that include unexpected post ID parameters
• Temporarily remove or unpublish sensitive private and draft content from sites running the vulnerable plugin

# Update MW WP Form to the patched release using WP-CLI
wp plugin update mw-wp-form

# Verify the installed version is later than 5.1.2
wp plugin get mw-wp-form --field=version