The MW WP Form plugin for WordPress has an insufficient access control check that allows unauthenticated users to retrieve post data through the 'post_id' query parameter. This allows attackers to read the contents or metadata of password protected, private, or draft posts, compromising confidential information. The weakness is a classic Insecure Direct Object Reference represented by CWE‑639.

The vulnerability affects all MW WP Form versions up to and including 5.1.2. The plugin is a WordPress plugin developed by websoudan and is publicly available through the WordPress plugin repository. No specific operating system or server platform is mentioned; the issue exists regardless of the host environment.

The CVSS score of 5.3 indicates a moderate level of severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by crafting a URL that includes an arbitrary post_id; no authentication is required. No publicly documented exploit exists at this time, but the moderate score and lack of mitigation in affected versions mean the risk is non‑negligible.