What is the CVSS score of CVE-2026-9179?

CVE-2026-9179 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of WP Forms Connector are affected by CVE-2026-9179?

WP Forms Connector WordPress plugin versions through 1.8 contains a SQL injection vulnerability in the REST API coupled with a defective authentication control that allows attackers to extract…

How to fix or mitigate CVE-2026-9179?

Within 24 hours: Identify all WordPress installations using WP Forms Connector versions ≤1.8; disable the plugin immediately or implement firewall rules blocking /wp-json/wp/v3/post/list endpoint access. Within 7 days: Monitor WP Forms vendor security advisories for patched version availability; test in staging environment. Within 30 days: Deploy vendor patch across all production WordPress installations; verify SQL injection payloads are blocked.

WP Forms Connector CVE-2026-9179

EUVD-2026-38661 HIGH

SQL Injection (CWE-89)

2026-06-24 Wordfence

GHSA-rx79-c7q2-h79q

SQLi WordPress Wp Forms Connector

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Endpoint is internet-reachable with broken auth (AV:N/AC:L/PR:N/UI:N); read-only ORDER BY SQLi exfiltrates data (C:H) but does not modify or deny service (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:51 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based check that validates the supplied 'Username' corresponds to an administrator account while never verifying the 'Password'. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

SQL injection in the WP Forms Connector WordPress plugin (versions up to and including 1.8) allows unauthenticated remote attackers to extract sensitive database contents via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint. The endpoint is exposed with permission_callback '__return_true' and only validates a 'Username' header against an administrator account without verifying the corresponding 'Password', making the authentication check trivially bypassable. No public exploit identified at time of analysis, but the trivial bypass and unsanitized ORDER BY concatenation make weaponization straightforward.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL Injection occurring in the listPost() function of WP-Forms-Connector.php (around line 1244/1259), where $_GET['order'] is assigned to $shorting and concatenated unquoted into the ORDER BY clause of a query executed through $wpdb->get_results() without $wpdb->prepare(). Because the injection point is in an ORDER BY clause, common defenses like quoting do not apply, and UNION-based or stacked subquery techniques (e.g., via CASE/IF expressions or time-based payloads) are typically used. Compounding the issue, the affected REST route is registered with WordPress's permission_callback set to '__return_true', so authorization is delegated to an in-function header check that compares the 'Username' header to an administrator login but never validates the 'Password' header - meaning any attacker who knows or guesses an admin username (often discoverable via /wp-json/wp/v2/users or author archives) bypasses authentication entirely. The CPE cpe:2.3:a:hancock11:wp_forms_connector:*:*:*:*:*:*:*:* identifies the vendor 'hancock11' and product 'wp_forms_connector' on the WordPress plugin platform.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the input data does not name a fixed plugin release, so administrators should upgrade to the latest WP Forms Connector version greater than 1.8 once published and monitor the Wordfence advisory (wordfence.com/threat-intel/vulnerabilities/id/2cd53590-ded1-4e68-a9a3-aa1d2d880b80) and the plugin trac for a tagged release. Until a patched version is available, deactivate and remove the plugin if not strictly required, since it is the only reliable mitigation; alternatively, block external access to the /wp-json/wp/v3/post/list REST route at the web server or WAF layer (note: this will break any legitimate consumer of that endpoint), or apply Wordfence/WAF virtual-patching rules that reject non-whitelist values in the 'order' query parameter and stacked-query payloads. Renaming or disabling well-known admin usernames reduces but does not eliminate the header-bypass risk and should not be relied on as a primary control.