Medium severity · published Oct 29, 2026
CVE-2026-92086
MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
New
5.3
CVSS
–
EPSS
No
On KEV
Description
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
MW WP Form · websoudan
through 5.1.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92086
github.com
https://github.com/web-soudan/mw-wp-form/compare/5.1.6...5.1.8
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L156
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L165
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L208
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e412f8a-f872-47cf-bbce-554b3559ef8a?source=cve
More from MW WP Form
7.2
CVE-2026-96567
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
5.3
CVE-2026-6206
MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
4.4
CVE-2026-8853
MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter