Is CVE-2026-9178 actively exploited?

No active exploitation of CVE-2026-9178 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9178 be exploited remotely?

Yes. CVE-2026-9178 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9178?

CVE-2026-9178 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-9178

HIGH

CVE-2026-9178

CWE-862Published: June 24, 2026· Updated: Jun 25, 2026

7.5

CVSS v3.1

EPSS:0.35%probability of exploitation in 30 daysPercentile:26.6th

Official Description

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.

NVD Source

Technical Analysis

CVE-2026-9178 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.