The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() fun…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Plugin source · wordpress.org

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · NIST NVD

   Detected

   The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

2. Jun 17, 2026 · NIST NVD

   Updated

   The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

Sources

• CVE.orgVulnerability recordCVE-2026-6206

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6206

  The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated

  nvd.nist.gov

References

• Reference · github.com
• Reference · plugins.trac.wordpress.org
• Reference · wordfence.com