CVE-2026-9179 is an SQL Injection vulnerability in the WP Forms Connector WordPress plugin (up to version 1.8). The vulnerability arises because the 'order' parameter from the REST endpoint /wp-json/wp/v3/post/list is read directly from user input and concatenated unquoted into an SQL ORDER BY clause without using $wpdb->prepare(). The endpoint uses a flawed permission callback that only verifies the 'Username' header corresponds to an administrator but does not verify the password, effectively allowing unauthenticated attackers to inject arbitrary SQL commands. This can lead to unauthorized data disclosure from the database.

An attacker can exploit this vulnerability without authentication to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability according to the CVSS vector. The high CVSS score (7.5) reflects the ease of exploitation and the impact on data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST endpoint or disable the WP Forms Connector plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.