Sensitive Information Exposure in MW WP Form by WordPress

CVE-2026-92086

What is CVE-2026-92086?

The MW WP Form plugin for WordPress has a vulnerability that allows unauthenticated attackers to extract sensitive personal information. By manipulating the 'post_id' parameter, attackers can enumerate sequential post IDs to access users' form inquiry records. This includes names, email addresses, and message bodies. Although exploitation is contingent upon the querystring setting being enabled, which is a common feature of the plugin, this flaw poses significant privacy risks for users who rely on this plugin for form submissions.

References