CVE-2026-92086

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.8

Description Unauthenticated attackers can extract personally identifiable information from form inquiry records, such as names, email addresses, and message bodies. This occurs by enumerating sequential values of the post id parameter. The issue is exploitable when the targeted form has the querystring setting enabled.

Recommendations Update MW WP Form to version 5.1.8 or later. Disable the querystring setting on forms to minimize the risk of exploitation.