CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92086?
CVE-2026-92086 is a medium-severity vulnerability in websoudan MW WP Form, published on 29 Oct 2026.
Official description
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.
Weakness: CWE-200
Which versions are affected by CVE-2026-92086?
How do I fix CVE-2026-92086?
No fix has been published for CVE-2026-92086 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92086 being exploited?
There is no known exploitation of CVE-2026-92086 in the wild and no public exploit code.
Sources
Also known as GHSA-qmfm-c92p-p9qm.