Executive brief
The MW WP Form WordPress plugin processes user-submitted form data and can echo values back to visitors in completion messages. Due to improper handling of shortcodes, an attacker can inject malicious shortcodes into form submissions that get executed server-side, allowing them to run any shortcode registered on the site without authentication. This requires the site to be configured to display the submitted value back to the user.
Technical details
The vulnerability is a shortcode injection flaw in the MW WP Form plugin's completion message merge functionality. When user-submitted form values are merged into completion messages, the plugin fails to escape or isolate them before processing the entire message for shortcode expansion. An unauthenticated attacker can craft a form submission containing a closing tag for the completion message wrapper (e.g., `[/mwform_complete_message]`) followed by a malicious shortcode payload, causing the injected shortcode to be executed at the top level of the string processor. The attack requires no authentication or privileged user interaction, only that the form be publicly accessible and configured to echo the submitted value in the completion message. The vulnerability was fixed in version 5.1.5.
Affected products
- MW WP Form MW WP Form before 5.1.5
Timeline
- 2026-08-27: disclosed
- 2026-05-15: patched: Fixed in version 5.1.5
- 2026-09-01: advisory