{"id":"CVE-2026-92086","kind":"vulnerability","aliases":["CVE-2026-92086"],"related":[],"title":"MW WP Form WordPress plugin exposes other users' form submissions by ID","description":"The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.","summary":"The MW WP Form plugin for WordPress, in versions up to and including 5.1.7, lets an unauthenticated visitor read form inquiry records by changing the post_id parameter. An attacker can enumerate sequential IDs to pull names, email addresses and message bodies submitted by other people.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mw-wp-form","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","querystring-disabled"],"how_to_check":"- Check the installed MW WP Form version in the WordPress plugins screen or `wp plugin get mw-wp-form --field=version`\n- Look for the querystring setting enabled on forms in the plugin's form settings; the sources say exploitation needs it on","fix":null,"status":"open","published_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","triaged_at":"2026-10-29T12:25:35+00:00","updated_at":"2026-10-29T12:25:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T12:25:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MW WP Form WordPress plugin exposes other users' form submissions by ID","impact":"medium","summary":"The MW WP Form plugin for WordPress, in versions up to and including 5.1.7, lets an unauthenticated visitor read form inquiry records by changing the post_id parameter. An attacker can enumerate sequential IDs to pull names, email addresses and message bodies submitted by other people.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mw-wp-form","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Form submitters' names, emails and messages readable by anyone","analyst_note":"Sources give no fixed version; check the plugin's changelog or the WordPress.org listing for a release after 5.1.7.","how_to_check":"- Check the installed MW WP Form version in the WordPress plugins screen or `wp plugin get mw-wp-form --field=version`\n- Look for the querystring setting enabled on forms in the plugin's form settings; the sources say exploitation needs it on","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","querystring-disabled"],"who_is_affected":"Sites running the MW WP Form plugin at version 5.1.7 or earlier where a form has the querystring setting enabled. The sources do not say whether a patched version exists; sites on managed hosting or with no MW WP Form forms can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4202,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92086':15A,18A '5.1.7':41B,94C 'address':66B,122C 'attack':57B,106C 'bodi':69B,128C 'chang':51B 'cve':13A,16A 'document':150C 'email':65B,121C 'enabl':144C 'enumer':59B,130C 'exploit':134C 'expos':6A 'exposur':86C 'extract':108C 'featur':151C 'form':3A,9A,22B,31B,47B,77C,115C,138C 'free':125C 'free-text':124C 'host':26B 'id':12A,54B,61B,98C,133C 'identifi':110C 'includ':40B,93C,118C 'inform':85C,111C 'inquiri':48B,116C 'let':42B 'make':101C 'messag':68B,127C 'mw':1A,20B,29B,75C 'mw-wp-form':19B 'name':64B,120C 'packag':23B 'paramet':55B,99C 'peopl':73B 'person':109C 'plugin':5A,32B,78C,154C 'possibl':103C 'post':53B,97C,132C 'pull':63B 'querystr':142C 'read':46B 'record':49B,117C 'requir':135C 'self':25B 'self-host':24B 'sensit':84C 'sequenti':60B,131C 'set':143C 'standard':149C 'submiss':10A 'submit':70B,119C 'target':137C 'text':126C 'unauthent':44B,105C 'user':8A,114C 'version':36B,89C 'via':95C 'visitor':45B 'vulner':82C 'wordpress':4A,27B,34B,80C 'wp':2A,21B,30B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MW WP Form plugin at version 5.1.7 or earlier where a form has the querystring setting enabled. The sources do not say whether a patched version exists; sites on managed hosting or with no MW WP Form forms can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92086","severity":null,"published_at":"2026-10-29T12:17:14+00:00","modified_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","fetched_at":"2026-10-29T12:24:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}