Information Exposure Vulnerability in WP Forms Connector Plugin by WordPress

CVE-2026-9178

What is CVE-2026-9178?

The WP Forms Connector plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the REST route wp/v3/user/list/. Due to the permission callback being set to '__return_true', any attacker can leverage a valid administrator username, such as 'admin', to generate a request inclusive of an arbitrary password value. This flaw allows access to sensitive information, including the WordPress password hash and email addresses of registered users, effectively exposing user data without proper authentication checks.

References