CVE-2026-78363: MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags
The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MW WP Form WordPress pluginto a version that resolves this vulnerability.Fixed in 5.1.5
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using MW WP Form versions before 5.1.5 are exposed only when a form is configured to echo a user-submitted value back to the visitor after submission. The attacker does not need to be authenticated.
What does an attacker need to do to exploit this issue?
An attacker must submit a value containing a shortcode through an affected form. If that submitted value is merged into a completion message that is later processed for shortcodes, any shortcode registered on the site may be executed.
What is the recommended remediation?
Update MW WP Form to version 5.1.5 or later. If updating is not immediately possible, review completion-message configurations and stop echoing submitted values back to visitors.
How can I determine whether my configuration is affected?
Check whether the installed MW WP Form version is earlier than 5.1.5, then review affected forms' completion messages for settings or merge tags that include user-submitted values. A form is relevant when those values are shown to the visitor after submission.