CVE-2026-9178

Name of the Vulnerable Software and Affected Versions WP Forms Connector versions prior to 1.9

Description The plugin contains an information exposure flaw via the REST route 'wp/v3/user/list/' which uses the userDetail() function. The authentication mechanism only checks if the Username HTTP header corresponds to an administrator account and if the Password HTTP header is not empty, failing to validate the password using wp check password(). This allows unauthenticated attackers to retrieve sensitive data for any registered user ID, such as the email address and the WordPress password hash (user pass), by providing a valid administrator username and any arbitrary password.

Recommendations Disable the plugin or restrict access to the 'wp/v3/user/list/' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.