CVE-2026-9178 is a missing authorization vulnerability (CWE-862) in the WP Forms Connector WordPress plugin by hancock11. The plugin registers a REST API endpoint wp/v3/user/list/<id> with a permission callback that always returns true, effectively bypassing authorization checks. The authentication mechanism only verifies that the 'Username' HTTP header corresponds to an administrator account and that the 'Password' header is non-empty, but it does not validate the password using wp_check_password(). This flaw allows unauthenticated attackers to retrieve sensitive information for any user ID, including password hashes and email addresses, by sending a request with a valid admin username and any arbitrary password value.

An attacker can obtain sensitive user information such as password hashes and email addresses without authentication. This exposure can lead to further attacks like offline password cracking or targeted phishing. The vulnerability does not allow modification or deletion of data but compromises confidentiality of user credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST endpoint and monitor for suspicious requests. Avoid using the plugin or downgrade to a version without this vulnerability if possible.