WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter

An unauthenticated attacker can send a GET request to the `/wp/v3/post/list` REST endpoint with a malicious `order` parameter. Because the endpoint's `permission_callback` is `'__return_true'` and the header-based authentication only checks that the `Username` header matches an administrator account (without verifying the `Password`), the attacker bypasses authentication. The unsanitized `order` value is injected directly into the `ORDER BY` clause, enabling SQL injection that can be leveraged to extract sensitive database contents.

The vulnerability resides in the `listPost()` method of the `wpCommonAPI` class (registered at `/wp/v3/post/list`). The `$shorting` variable is populated directly from `$_GET['order']` and concatenated unquoted into the `ORDER BY` clause of a SQL query executed via `$wpdb->get_results()` without using `$wpdb->prepare()`. Additionally, the endpoint's `permission_callback` is set to `'__return_true'`, and the header-based authentication check validates only that the supplied `Username` corresponds to an administrator account without verifying the `Password`.

The advisory does not provide a patch. To remediate, the `$shorting` value must be validated against a whitelist of allowed sort directions (e.g., `ASC` or `DESC`) and the SQL query should use `$wpdb->prepare()` with a placeholder instead of direct concatenation. Additionally, the authentication logic must be corrected to actually verify the password via `wp_signon()` or `wp_check_password()` rather than merely checking that a username exists.