Executive brief
The WP Forms Connector plugin for WordPress, which helps manage form data, contains a security flaw that allows unauthorized access to user information. An attacker can exploit this to steal sensitive data such as email addresses and encrypted password hashes for any user on the site. This could lead to full account takeovers if the password hashes are cracked or if the information is used for targeted phishing attacks.
Technical details
The WP Forms Connector plugin suffers from an information exposure vulnerability in its 'userDetail()' callback function, which is registered to the REST route 'wp/v3/user/list/<id>'. The 'permission_callback' is set to '__return_true', and the internal authentication logic only checks if a 'Username' header matches an administrator and if a 'Password' header is present, without actually verifying the password via 'wp_check_password()'. An unauthenticated remote attacker can exploit this by providing a known admin username (like 'admin') and any non-empty string as a password to retrieve sensitive user data, including 'user_pass' hashes and email addresses. All versions up to and including 1.8 are affected.
Affected products
- hancock11 WP Forms Connector up to, and including, 1.8
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dfafee-9b6c-4e57-b263-39ff15cd3b51?source=cve