Threat Entry Updated 2026-06-25

CVE-2026-9179 - Wp Forms Connector Plugin

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based…

PLUGIN Wp Forms Connector

CVE-2026-9179

HIGH CVSS 7.5 2026-06-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-25

CVE-2026-9178 - Wp Forms Connector Plugin

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID…

PLUGIN Wp Forms Connector

CVE-2026-9178

HIGH CVSS 7.5 2026-06-24

Risk Score

Open Full Technical Breakdown