Threats tagged 'ghsa-qmfm-c92p-p9qm'

The MW WP Form plugin for WordPress versions up to and including 5.1.7 is vulnerable to sensitive information exposure via the 'post_id' parameter. This vulnerability allows unauthenticated attackers to enumerate sequential post IDs and extract personally identifiable information such as names, email addresses, and message contents from other users' form submissions. Exploitation requires the targeted form to have the querystring setting enabled, which is a standard documented feature of the plugin.