CVE-2026-6206

The MW WP Form plugin for WordPress contains a flaw in its handling of post properties, allowing unauthorized users to retrieve sensitive information from restricted posts across all versions prior to 5.1.2. This vulnerability stems from inadequate controls on which posts can be accessed through the _get_post_property_from_querystring() function. As a result, attackers without authentication can extract data from password-protected or private posts that they shouldn't have access to.

Based on public CVE data (MITRE/NVD).