hancock11 WP Forms Connector Plugin up to 1.8 on WordPress Password Hash /v3/user/list userDetail authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in hancock11 WP Forms Connector Plugin up to 1.8 on WordPress. Affected by this vulnerability is the function userDetail of the file /v3/user/list of the component Password Hash Handler. The manipulation results in authorization. This vulnerability is cataloged as CVE-2026-9178. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in hancock11 WP Forms Connector Plugin up to 1.8 on WordPress. It has been classified as problematic. Affected is the function userDetail of the file /v3/user/list of the component Password Hash Handler. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. CVE summarizes:

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.

The weakness was shared by jamaal. The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-9178 since 05/21/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.8 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• hancock11

Name

• WP Forms Connector Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion