The WP Forms Connector plugin for WordPress receives an unsanitized "order" parameter from the /wp-json/wp/v3/post/list REST endpoint, concatenating it directly into an SQL ORDER BY clause without quoting or preparation. This flaw, a classic SQL injection (CWE‑89), permits an attacker to inject arbitrary SQL that is executed via $wpdb->get_results(), enabling extraction of sensitive database contents. Because the endpoint uses a permissive permission_callback and a broken header check that never verifies the supplied password, the vulnerability is exploitable by unauthenticated users.

Versions of the WP Forms Connector plugin up to and including 1.8, distributed by the vendor hancock11, are affected. WordPress sites that have installed these versions expose the vulnerable REST endpoint.

The CVSS score of 7.5 indicates a high severity. EPSS data is not available, but the lack of authentication around the endpoint makes exploitation straightforward for anyone with network access to the site. The vulnerability is not listed in CISA KEV, so no confirmed exploits are publicly documented yet, but the attack vector and high impact warrant immediate attention.