CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.
Explanation of Vulnerability in Simple Terms
MW WP Form versions before 5.1.5 contain a vulnerability allowing attackers to read sensitive data and modify site content. The attack requires specific network conditions but no user authentication or interaction. The vulnerability affects confidentiality and integrity of the form plugin's data handling.
What an attacker can do
Read sensitive data and modify form content or settings without authentication.
Potential impact on your site
Form data confidentiality and integrity compromised; users' submissions may be exposed or altered.
Conditions required to exploit
Network access; specific conditions must be met (high attack complexity).
Key dates
External resources
