WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint

An unauthenticated attacker sends a GET request to `/wp-json/wp/v3/user/list/<id>` with a `Username` HTTP header set to a known administrator login (commonly the default 'admin') and any arbitrary non-empty `Password` HTTP header. The plugin's home-grown authentication only checks that the username exists as an administrator and that the password header is not empty, without verifying the password against the stored hash. This allows the attacker to retrieve the full user object for any registered user ID, including the WordPress password hash (`user_pass`) and email address.

The `wpCommonAPI` class registers the REST route `wp/v3/user/list/(?P<id>[\d]+)` with `permission_callback` set to `'__return_true'`. The callback `userDetail()` reads `Username` and `Password` HTTP headers but only verifies that the username maps to an administrator account and that the password header is non-empty — it never calls `wp_check_password()` to validate the password. This contrasts with the sibling `delete_wc_user()` function which does perform proper password validation.

The advisory does not include a patch diff, but the remediation is clear: the `userDetail()` callback must call `wp_check_password($password, $user->data->user_pass, $user->ID)` to validate the supplied password against the stored hash, as the sibling `delete_wc_user()` function already does. Additionally, the `permission_callback` should be changed from `'__return_true'` to a proper capability check such as `'current_user_can'` to prevent unauthenticated access entirely.