What is the CVSS score of CVE-2026-9178?

CVE-2026-9178 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WP Forms Connector are affected by CVE-2026-9178?

The WP Forms Connector WordPress plugin (through version 1.8) exposes user credentials and email addresses to any unauthenticated attacker, creating immediate account takeover risk across the entire…

How to fix or mitigate CVE-2026-9178?

Within 24 hours: Disable and remove WP Forms Connector versions 1.8 and earlier from all WordPress installations; immediately force password reset for all user accounts. Within 7 days: Audit access logs for the /wp/v3/user/list REST endpoint to identify potential exploitation; review user account activity for unauthorized access. Within 30 days: Monitor vendor advisories for a patched release (version 1.9+); if unavailable, evaluate alternative form plugins with security vetting.

WP Forms Connector CVE-2026-9178

EUVD-2026-38689 HIGH

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-q7pg-wxgw-7v4g

Information Disclosure Authentication Bypass WordPress Wp Forms Connector

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

REST endpoint is network-reachable with no auth or user interaction; broken check accepts any password, leaking password hashes and emails - confidentiality only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:52 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID - including the WordPress password hash (user_pass) and email address - by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Information disclosure in the WP Forms Connector WordPress plugin (versions through 1.8) allows unauthenticated remote attackers to retrieve any user's password hash and email address via the wp/v3/user/list/<id> REST route. The endpoint's permission_callback is hard-coded to __return_true and the bespoke auth check verifies only that the Username header maps to an administrator (typically 'admin') without ever calling wp_check_password() to validate the supplied Password header. No public exploit identified at time of analysis, but the trivial nature of the bypass and the exposure of user_pass hashes make this a credible account-takeover vector.

Technical ContextAI

The vulnerability lives in the WP Forms Connector plugin's REST API integration (WP-Forms-Connector.php around line 1464-1490) for the WordPress core REST framework. WordPress lets developers register routes with a permission_callback that authorizes the request; setting it to '__return_true' tells WordPress to allow any caller, leaving authorization to in-handler logic. The userDetail() callback then performs a home-rolled check that looks up the WP_User by the 'Username' HTTP header and confirms the account has the administrator role and that a 'Password' header was sent, but never calls wp_check_password() against the stored hash, in contrast to the sibling delete_wc_user() handler which does verify the password. This is a textbook CWE-862 Missing Authorization defect: the resource is reachable but the access-control decision is not actually enforced, leaking the entire WP_User object including user_pass (PHPass hash) and user_email for any numeric ID.

RemediationAI

No vendor-released patch identified at time of analysis - the Wordfence write-up and the plugin's trac source still reference version 1.8 as the latest vulnerable release, so operators cannot yet rely on a simple upgrade. The cleanest mitigation is to deactivate and remove the WP Forms Connector plugin until a fixed version is published; this is disruptive only on sites that actively depend on its form-connector functionality. As compensating controls, block external access to the /wp-json/wp/v3/user/list/ route at the web server, reverse proxy, or WAF layer (this trades off any legitimate use of that endpoint), rename the default 'admin' account to a non-guessable login to raise the cost of the Username-header attack (this does not fix the bypass, only narrows it), and rotate all administrator and high-value user passwords on the assumption that user_pass hashes may already have been exfiltrated. Monitor the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/f5dfafee-9b6c-4e57-b263-39ff15cd3b51 for the patched version once published.