CVE-2026-6206

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-620607.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivat CVE-2026-620615.3Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities all CVE-2026-620628.8Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elemento CVE-2026-620635.4Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Contr CVE-2026-620647.1Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.CVE-2026-620658.1Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.CVE-2026-620668.1Unauthenticated Local File Inclusion in Volos <= 1.2 versions.CVE-2026-620678.1Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.CVE-2026-620688.1Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.CVE-2026-620698.1Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.CVE-2026-620708.1Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.CVE-2026-620719.3Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.