EUVD-2026-38661
GHSA-rx79-c7q2-h79q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Endpoint is internet-reachable with broken auth (AV:N/AC:L/PR:N/UI:N); read-only ORDER BY SQLi exfiltrates data (C:H) but does not modify or deny service (I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based check that validates the supplied 'Username' corresponds to an administrator account while never verifying the 'Password'. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
SQL injection in the WP Forms Connector WordPress plugin (versions up to and including 1.8) allows unauthenticated remote attackers to extract sensitive database contents via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint. The endpoint is exposed with permission_callback '__return_true' and only validates a 'Username' header against an administrator account without verifying the corresponding 'Password', making the authentication check trivially bypassable. No public exploit identified at time of analysis, but the trivial bypass and unsanitized ORDER BY concatenation make weaponization straightforward.
Technical ContextAI
The vulnerability is a classic CWE-89 SQL Injection occurring in the listPost() function of WP-Forms-Connector.php (around line 1244/1259), where $_GET['order'] is assigned to $shorting and concatenated unquoted into the ORDER BY clause of a query executed through $wpdb->get_results() without $wpdb->prepare(). Because the injection point is in an ORDER BY clause, common defenses like quoting do not apply, and UNION-based or stacked subquery techniques (e.g., via CASE/IF expressions or time-based payloads) are typically used. Compounding the issue, the affected REST route is registered with WordPress's permission_callback set to '__return_true', so authorization is delegated to an in-function header check that compares the 'Username' header to an administrator login but never validates the 'Password' header - meaning any attacker who knows or guesses an admin username (often discoverable via /wp-json/wp/v2/users or author archives) bypasses authentication entirely. The CPE cpe:2.3:a:hancock11:wp_forms_connector:*:*:*:*:*:*:*:* identifies the vendor 'hancock11' and product 'wp_forms_connector' on the WordPress plugin platform.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the input data does not name a fixed plugin release, so administrators should upgrade to the latest WP Forms Connector version greater than 1.8 once published and monitor the Wordfence advisory (wordfence.com/threat-intel/vulnerabilities/id/2cd53590-ded1-4e68-a9a3-aa1d2d880b80) and the plugin trac for a tagged release. Until a patched version is available, deactivate and remove the plugin if not strictly required, since it is the only reliable mitigation; alternatively, block external access to the /wp-json/wp/v3/post/list REST route at the web server or WAF layer (note: this will break any legitimate consumer of that endpoint), or apply Wordfence/WAF virtual-patching rules that reject non-whitelist values in the 'order' query parameter and stacked-query payloads. Renaming or disabling well-known admin usernames reduces but does not eliminate the header-bypass risk and should not be relied on as a primary control.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today