CVE-2026-9179

Name of the Vulnerable Software and Affected Versions WP Forms Connector versions prior to 1.9

Description An issue exists where unauthenticated attackers can execute additional SQL queries to extract sensitive information from the database. This occurs via the /wp-json/wp/v3/post/list REST endpoint through the order parameter. The flaw is caused by insufficient escaping of the order parameter and a lack of proper preparation in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get results() without using $wpdb->prepare(). Additionally, the endpoint uses a broken header-based check that validates if a provided 'Username' belongs to an administrator but fails to verify the 'Password'.

Recommendations Update WP Forms Connector to version 1.9 or later. As a temporary mitigation, restrict access to the /wp-json/wp/v3/post/list REST endpoint.