CVE-2026-6206 is an information exposure vulnerability in the MW WP Form plugin for WordPress, affecting all versions up to and including 5.1.2. The issue arises from insufficient access control in the _get_post_property_from_querystring() function, allowing unauthorized users to retrieve content from restricted posts such as password protected, private, or draft posts. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An unauthenticated attacker can extract sensitive information from posts that are intended to be protected, including password protected, private, or draft posts. This leads to unauthorized disclosure of potentially sensitive content. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or disabling it if possible to prevent unauthorized data exposure.