점검 대응높음KEV 미등록
CVE-2026-9179
hancock11 WP Forms Connector 취약점
The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_t...
- 대응 우선순위
- 점검
- CVSS
- 7.5
- EPSS
- 0.38% 백분위 29.8% · 2026.07.15 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.06.24