CVE-2026-9179 describes an SQL Injection vulnerability in the WP Forms Connector WordPress plugin (<=1.8). The vulnerability arises from insufficient escaping of the 'order' parameter in the /wp-json/wp/v3/post/list REST endpoint. The parameter is read directly from user input and concatenated unquoted into an SQL ORDER BY clause executed via $wpdb->get_results() without using $wpdb->prepare(). The endpoint is registered with a permission callback that always returns true and performs only a broken header-based check validating the 'Username' as an administrator without verifying the password. This allows unauthenticated attackers to append malicious SQL queries to extract sensitive database information.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability but has high confidentiality impact. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected REST endpoint or restricting access to trusted administrators only. Avoid exposing the vulnerable endpoint publicly and monitor for suspicious activity related to the 'order' parameter. Do not rely on the existing broken permission check as it does not prevent exploitation.