The MW WP Form WordPress plugin merges user‑submittable values into a completion message that is later parsed for shortcodes, but it does not sanitize these values. An unauthenticated user can therefore inject any shortcode that is registered on the site. If the injected shortcode performs privileged actions or exposes data, the attacker effectively gains the ability to execute arbitrary code through the shortcode mechanism.

The vulnerability affects installations of the MW WP Form plugin version 5.1.5 and older. It is relevant to WordPress sites that use any of these plugin versions, regardless of other plugin or theme versions.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is less than 1%. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires that the site be configured to echo a submitted value back to the visitor after form submission, a common behaviour in many contact‑form setups. Because authentication is not required, the attack vector is effectively public: a malicious form submission can trigger the shortcode execution without any additional access or network privilege.