Executive brief
The WP Forms Connector plugin for WordPress, which helps manage form data, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending a specially crafted web request, an attacker can bypass security checks and run their own database commands. This could lead to the theft of user data, site configuration details, or other private information stored in the website's database.
Technical details
The WP Forms Connector plugin for WordPress (up to and including version 1.8) is vulnerable to unauthenticated SQL injection. The vulnerability exists in the listPost() function, which processes the /wp-json/wp/v3/post/list REST endpoint. The 'order' parameter is read directly from $_GET and concatenated unquoted into an ORDER BY clause without using $wpdb->prepare() or sufficient escaping. Although the endpoint attempts a header-based authentication check, it only validates that the provided 'Username' exists as an administrator and fails to verify the 'Password', effectively allowing unauthenticated access. Attackers can exploit this to extract sensitive data from the WordPress database via time-based or boolean-based injection techniques.
Affected products
- hancock11 WP Forms Connector up to and including 1.8
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://plugins.trac.wordpress.org/browser/wp-forms-connector/tags/1.8/WP-Forms-Connector.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd53590-ded1-4e68-a9a3-aa1d2d880b80?source=cve