CVE-2026-78363: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in MW WP Form

The MW WP Form plugin for WordPress prior to version 5.1.5 suffers from improper neutralization of special elements in output used by a downstream component (CWE-74). Specifically, shortcodes submitted by unauthenticated users are not sanitized and can be executed when the plugin merges these values into messages processed for shortcodes. This vulnerability allows execution of any shortcode registered on the site, potentially leading to unauthorized actions or information disclosure if the site echoes submitted values back to visitors.

An attacker can execute arbitrary shortcodes on the affected WordPress site without authentication, which may lead to limited confidentiality and integrity impacts depending on the shortcodes available. The CVSS score of 4.8 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity. There is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid configurations that echo user-submitted values back to visitors or implement manual shortcode filtering in user inputs.