Executive brief
The MW WP Form plugin for WordPress, which is used to create and manage custom forms, contains a security flaw that allows unauthorized access to restricted content. An attacker can exploit this to view information from private, draft, or password-protected posts without needing to log in. This could lead to the exposure of sensitive internal data or unpublished website content.
Technical details
The MW WP Form plugin for WordPress is vulnerable to Information Exposure (CWE-639) due to insufficient restrictions in the _get_post_property_from_querystring() function within the class.parser.php file. The function fails to properly validate the post status or password requirements of a post before returning its properties via a query string parameter. An unauthenticated remote attacker can exploit this by sending crafted requests to access data from posts that are otherwise restricted, such as those in draft, private, or password-protected states. A patch has been released in subsequent versions to enforce checks for 'publish' status and password protection.
Affected products
- web-soudan MW WP Form up to, and including, 5.1.2
Timeline
- 2026-05-14: disclosed: Vulnerability published to NVD and Wordfence.
- 2026-05-14: advisory: Wordfence published detailed vulnerability information.