CVE-2026-92086
Received Received - Intake

Sensitive Information Exposure in MW WP Form Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: Wordfence

Description
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-92086
EUVD
EUVD-2026-112747

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
websoudan MW WP Form 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MW WP Form WordPress plugin has a vulnerability where unauthenticated attackers can access sensitive data by exploiting the 'post_id' parameter. This allows them to view personally identifiable information like names, email addresses, and messages from other users' form submissions by guessing sequential post IDs. The issue affects versions up to 5.1.7.

Detection Guidance

This vulnerability can be detected by checking if the MW WP Form plugin is installed and if its version is 5.1.7 or below. Exploitation attempts may involve unauthenticated requests to enumerate post IDs via the 'post_id' parameter. Monitor server logs for unusual GET requests targeting form endpoints with sequential IDs.

Impact Analysis

If you use the MW WP Form plugin up to version 5.1.7, attackers could steal personal data from your site's form submissions without needing to log in. This includes names, emails, and messages, which could lead to privacy breaches or be used for phishing or spam.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personally identifiable information without consent. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. A breach could result in legal penalties or fines.

Mitigation Strategies

Immediately update the MW WP Form plugin to version 5.1.8 or later. Disable the querystring setting feature if not required. Review server logs for signs of exploitation and restrict access to sensitive form data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92086. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart