CVE-2026-9178: WP Forms Connector Authentication Bypass Exposes User Password Hashes

Technical summary

CVE-2026-9178 affects WP Forms Connector through version 1.8. The vulnerable REST endpoint wp/v3/user/list/<id> uses permission_callback set to __return_true, disabling WordPress's native permission checks. The userDetail() callback implements custom authentication that validates the 'Username' header matches an administrator account but critically fails to verify the 'Password' header using wp_check_password(). Instead, it only checks that the Password header is non-empty. This is inconsistent with the sibling delete_wc_user() function in the same codebase, which correctly validates passwords. An unauthenticated attacker can enumerate user IDs and retrieve the wp_users table fields user_pass (password hash) and user_email by supplying a known admin username and arbitrary password.

Business impact

Password hashes for all registered users can be extracted and subjected to offline cracking attacks, potentially compromising admin and user accounts site-wide. Email addresses are exposed, enabling targeted phishing campaigns. The attack requires no interaction from legitimate users and can be automated at scale across multiple WordPress installations using this plugin. Credential compromise can lead to full site takeover, data theft, malware injection, and reputational damage.

Affected systems

WP Forms Connector plugin for WordPress, all versions up to and including 1.8. The vulnerability affects any WordPress installation where this plugin is installed and activated, regardless of other security configurations. Default WordPress installations with the 'admin' user are at highest risk due to predictable username enumeration.

Exploitability

Exploitation is trivial. The attack requires network access to the WordPress REST API and knowledge of a valid administrator username—neither of which is confidential. No authentication is needed, no CSRF tokens or user interaction, and no special tools beyond a web client. An attacker can retrieve any user's sensitive data with a simple HTTP GET request. The vulnerability is readily exploitable by unauthenticated remote attackers.

Remediation

Update WP Forms Connector to a version that fixes the authentication bypass. Verify the patch properly implements wp_check_password() to validate the Password header and aligns with WordPress security best practices. As a temporary mitigation, disable the plugin or restrict REST API access via web application firewall rules blocking requests to wp/v3/user/list/* endpoints until patched.

Patch guidance

Contact the WP Forms Connector vendor or check the plugin repository for version 1.9 or later. Verify against the official vendor advisory before deploying. Standard WordPress plugin updates via the dashboard should be available once a patch is released. After updating, test the REST endpoint to confirm the authentication check now validates passwords correctly.

Detection guidance

Monitor web server logs for HTTP requests to /wp-json/wp/v3/user/list/ with numeric ID parameters and the 'Username' and 'Password' headers. Legitimate administrative use of this endpoint should be rare or non-existent. Alert on successful 200 responses that contain user_pass or user_email fields. Network detection can identify characteristic patterns: requests from unexpected source IPs, multiple sequential user ID requests, or requests with default admin usernames paired with mismatched passwords.

Why prioritize this

A CVSS 7.5 (HIGH) vulnerability combining zero authentication requirements, high information impact, and trivial exploitability demands urgent patching. Password hash theft directly enables account compromise and lateral movement. The fix is straightforward but the exposure window is critical because password hashes are valuable and long-lived assets. Organizations running WP Forms Connector should treat this as a priority remediation item.

Risk score, explained

The CVSS 7.5 score reflects high impact (confidentiality breach of sensitive user data), no authentication requirement (PR:N), network-based attack vector, and low attack complexity. The score does not account for password cracking time or secondary attack likelihood, but the direct exposure of password hashes and emails—combined with unauthenticated access—justifies the HIGH severity rating. This is not an edge-case flaw; it is a fundamental authentication bypass in a public API endpoint.

Frequently asked questions