{"id":"CVE-2026-92086","revision":"ab5fb5d73af6416395479b3d5808e9b3","records":[{"revision":"ab5fb5d73af6416395479b3d5808e9b3","observedAt":"2026-10-29T13:12:12.589+00:00","statement":{"source":"cve-program","id":"CVE-2026-92086","aliases":[],"title":"MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter","description":"The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.","state":0,"publishedAt":"2026-10-29T11:27:15.236+00:00","modifiedAt":"2026-10-29T11:27:15.236+00:00","affected":[{"ecosystem":"Vendor product","name":"MW WP Form","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"websoudan\",\n                    \"product\": \"MW WP Form\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"5.1.7\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/7e412f8a-f872-47cf-bbce-554b3559ef8a?source=cve","https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L165","https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L156","https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L208","https://github.com/web-soudan/mw-wp-form/compare/5.1.6...5.1.8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92086","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92086","identifiers":["CVE-2026-92086"]},"retained":false,"historicalAffected":[]}],"coverage":[]}