cwp vulnerability