WP Forms Connector Unauthenticated Information Exposure (CVE-2026-9178)

Vulnerability Overview Vulnerability Name: WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint CVE ID: CVE-2026-9178 CVSS Score: 7.5 (High) Publication Date: June 23, 2026 Last Updated Date: June 24, 2026 Researcher: jamaal Impact Scope Software Type: Plugin Software Slug: wp-forms-connector Fixed: No Affected Versions: <= 1.8 Remediation Current Status: No known patches available. It is recommended to thoroughly review the vulnerability details and implement mitigation measures based on your organization's risk tolerance. Uninstalling the affected software and seeking an alternative may be necessary. Vulnerability Description The WP Forms Connector plugin (for WordPress) contains an information exposure vulnerability in versions 1.8 and earlier. The plugin registers the REST route (via the function) with a capability callback set to . Its custom authentication only verifies that the provided "Username" HTTP header maps to an administrator account and that the "Password" HTTP header is non-empty. It never uses to validate the password (unlike the function). This allows an unauthenticated attacker to retrieve sensitive information for any registered user ID, including the WordPress password hash (user_pass) and email address, by sending requests containing a valid administrator login (default is "admin") and any arbitrary password value. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Recent Vulnerability: WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter (CVE-2026-9179) Copyright: 2012-2026 Defiant Inc. Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, 365 days a year, 1-hour response time Contact Information Technical Support: wfi-support@wordfence.com Other Resources Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscribe: Enter your email address, check the box to agree to the Terms and Privacy Policy, and click "SIGN UP" Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Social Media Twitter: [Icon] Facebook: [Icon] LinkedIn: [Icon] Instagram: [Icon] Other Links Terms of Service: [Link] Privacy Policy and Notice at Collection: [Link] Do Not Sell or Share My Personal Information: [Link] Disclaimer Disclaimer: The content of this page is for reference purposes only and does not constitute any legal or technical advice. Users should assess risks and take appropriate measures on their own. Summary The WP Forms Connector plugin has a severe security vulnerability that may lead to unauthenticated information exposure. Users are advised to update or uninstall the plugin as soon as possible and to closely monitor official announcements for available patches.

Goal Reached Thanks to every supporter — we hit 100%!

WP Forms Connector Unauthenticated Information Exposure (CVE-2026-9178)

More from this source