EUVD-2026-38689
GHSA-q7pg-wxgw-7v4g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
REST endpoint is network-reachable with no auth or user interaction; broken check accepts any password, leaking password hashes and emails - confidentiality only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID - including the WordPress password hash (user_pass) and email address - by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.
Articles & Coverage 1
AnalysisAI
Information disclosure in the WP Forms Connector WordPress plugin (versions through 1.8) allows unauthenticated remote attackers to retrieve any user's password hash and email address via the wp/v3/user/list/<id> REST route. The endpoint's permission_callback is hard-coded to __return_true and the bespoke auth check verifies only that the Username header maps to an administrator (typically 'admin') without ever calling wp_check_password() to validate the supplied Password header. No public exploit identified at time of analysis, but the trivial nature of the bypass and the exposure of user_pass hashes make this a credible account-takeover vector.
Technical ContextAI
The vulnerability lives in the WP Forms Connector plugin's REST API integration (WP-Forms-Connector.php around line 1464-1490) for the WordPress core REST framework. WordPress lets developers register routes with a permission_callback that authorizes the request; setting it to '__return_true' tells WordPress to allow any caller, leaving authorization to in-handler logic. The userDetail() callback then performs a home-rolled check that looks up the WP_User by the 'Username' HTTP header and confirms the account has the administrator role and that a 'Password' header was sent, but never calls wp_check_password() against the stored hash, in contrast to the sibling delete_wc_user() handler which does verify the password. This is a textbook CWE-862 Missing Authorization defect: the resource is reachable but the access-control decision is not actually enforced, leaking the entire WP_User object including user_pass (PHPass hash) and user_email for any numeric ID.
RemediationAI
No vendor-released patch identified at time of analysis - the Wordfence write-up and the plugin's trac source still reference version 1.8 as the latest vulnerable release, so operators cannot yet rely on a simple upgrade. The cleanest mitigation is to deactivate and remove the WP Forms Connector plugin until a fixed version is published; this is disruptive only on sites that actively depend on its form-connector functionality. As compensating controls, block external access to the /wp-json/wp/v3/user/list/ route at the web server, reverse proxy, or WAF layer (this trades off any legitimate use of that endpoint), rename the default 'admin' account to a non-guessable login to raise the cost of the Username-header attack (this does not fix the bypass, only narrows it), and rotate all administrator and high-value user passwords on the assumption that user_pass hashes may already have been exfiltrated. Monitor the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/f5dfafee-9b6c-4e57-b263-39ff15cd3b51 for the patched version once published.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today