The WP Forms Connector plugin registers a REST route wp/v3/user/list/<id> that is supposed to be protected, but the permission_callback always returns true. The authentication logic only checks that the supplied Username header corresponds to an administrator and that a non‑empty Password header is present; it never validates the password. Consequently an unauthenticated user who knows an administrator login name (e.g. admin) can send a request and obtain the password hash and email address of any registered user. The vulnerability is a pure information‑exposure flaw with no impact on the integrity or availability of the site.

This issue affects the WP Forms Connector plugin for WordPress, version 1.8 and all earlier releases. Users of the plugin developed by Hancock11 should review the installed version and ensure it is upgraded to a fixed release if one exists.

The CVSS score of 7.5 indicates a high level of risk, and although an EPSS score is not available, the flaw is actively exploited in the wild, as documented in the Wordfence threat intel. Attackers only need to know an administrator username; no further credentials or network access are required. The weakness falls under CWE‑862 (Missing Authorization). Because the information exposed includes password hashes, this vulnerability is particularly severe for the confidentiality of user accounts. The risk is high enough that immediate attention is recommended.