Is CVE-2026-78363 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78363 being exploited in the wild.

How severe is CVE-2026-78363?

Medium severity, with a CVSS score of 4.8, published 1 September 2026.

Which products and versions are affected?

MW WP Form MW WP Form before 5.1.5.

Is there a fix for CVE-2026-78363?

A patch was published on 2026-05-15: Fixed in version 5.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78363 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78363?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78363: MW WP Form arbitrary shortcode execution in completion message

CVE-2026-78363 · Severity: medium · CVSS 4.8 · Published 2026-09-01

The MW WP Form WordPress plugin processes user-submitted form data and can echo values back to visitors in completion messages. Due to improper handling of shortcodes, an attacker can inject malicious shortcodes into form submissions that get executed server-side, allowing them to run any shortcode registered on the site without authentication. This requires the site to be configured to display the submitted value back to the user.

Quick answers

Is CVE-2026-78363 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78363 being exploited in the wild.
How severe is CVE-2026-78363?: Medium severity, with a CVSS score of 4.8, published 1 September 2026.
Which products and versions are affected?: MW WP Form MW WP Form before 5.1.5.
Is there a fix for CVE-2026-78363?: A patch was published on 2026-05-15: Fixed in version 5.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78363 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78363?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a shortcode injection flaw in the MW WP Form plugin's completion message merge functionality. When user-submitted form values are merged into completion messages, the plugin fails to escape or isolate them before processing the entire message for shortcode expansion. An unauthenticated attacker can craft a form submission containing a closing tag for the completion message wrapper (e.g., `[/mwform_complete_message]`) followed by a malicious shortcode payload, causing the injected shortcode to be executed at the top level of the string processor. The attack requires no authentication or privileged user interaction, only that the form be publicly accessible and configured to echo the submitted value in the completion message. The vulnerability was fixed in version 5.1.5.

Affected products

MW WP Form MW WP Form before 5.1.5

Timeline

2026-08-27: disclosed
2026-05-15: patched: Fixed in version 5.1.5
2026-09-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.