Vulnerabilities

TI-2026-08067 CVE-2026-9178 · GHSA-q7pg-wxgw-7v4g

WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint

MEDIUM 40

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00612 Published 2026-06-24 No fix listed CWE-862

TI-2026-08068 CVE-2026-9179 · GHSA-rx79-c7q2-h79q

WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter

LOW 39

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00505 Published 2026-06-24 No fix listed CWE-89

TI-2025-08511 CVE-2025-9286 · GHSA-5hv2-265f-8mm9

Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated…

MEDIUM 43

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00467 Published 2025-10-03 No fix listed CWE-620

Vulnerabilities

Filters

WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint

WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter

Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated…