VulnSocial

CVE-2026-9178Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-24); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-24: 1Mentions · 2026-06-25: 1PoC Mentioned / Linked · 2026-06-25: 1Patch / Workaround · 2026-06-24: 1Technical Details · 2026-06-24: 1Technical Details · 2026-06-25: 106-2406-25
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-241
Disclosure1
2026-06-251
PoC1
Full discourse2 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-9178-wp-forms-connector-version-1-8-high-vulnerability-proof-of-concept CVE-2026-9178 wp-forms-connector (CVSS Score 7.5) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomic…

    Post summary

    The post references a publicly available proof‑of‑concept for CVE‑2026‑9178 affecting the wp‑forms‑connector plugin (v1.8) with a CVSS score of 7.5, but does not indicate active exploitation, a patch, or a debunking claim.

    0000048
    11 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-9178 - Info disclosure in #WP Forms Connector plugin ≤1.8. #REST endpoint exposes user data; auth bypass via arbitrary Username/Password headers. #CVSS 7.5. No patch. Disable plugin or restrict access immediately. #WordPress #infosec #developers #hosting More info: https://www.valtersit.com/cve/CVE-2026-9178/

    Post summary

    CVE-2026-9178 is a disclosed issue in WP Forms Connector plugin versions ≤1.8, allowing an authentication bypass via custom Username/Password headers to expose user data; rated CVSS 7.5, no patch available—disable the plugin or restrict access immediately.

    0000086
    962 followersView on X

Explore more

Back to dashboard