WP Forms Connector vulnerabilities

2 known vulnerabilities in WP Forms Connector from Hancock11. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  WP Forms Connector: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-9179Jun 24, 2026Hancock11

  The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter

• 7.5 High severity

  WP Forms Connector: Missing Authorization

  CVE-2026-9178Jun 24, 2026Hancock11

  The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and t