SQL Injection Vulnerability in WP Forms Connector for WordPress

CVE-2026-9179

What is CVE-2026-9179?

The WP Forms Connector plugin for WordPress exhibits vulnerabilities due to insufficient input validation and escaping in its '/wp-json/wp/v3/post/list' REST endpoint. An attacker can manipulate the 'order' parameter, injecting malicious SQL queries that could expose sensitive database information. This vulnerability arises from a lack of prepared statements and insecure handling of user inputs. Furthermore, the inadequate authentication checks allow unauthenticated users to exploit this weakness, exacerbating the risk to WordPress installations. Users should promptly update to the latest version to mitigate this risk.

References