EUVD-2026-37842
GHSA-m85c-v3hh-52xc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Plugin is network-accessible via WordPress admin; administrator authentication required (PR:H); read-only database extraction means C:H with I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level attackers via the unsanitized 'groupids' parameter. All plugin versions through 1.15.43 are affected across multiple code paths in WDW_FM_Library.php and Generete_csv.php. No active exploitation is confirmed (not in CISA KEV), and exploitation is constrained by the administrator privilege requirement, though the high confidentiality impact from unrestricted database read access remains a meaningful concern for multi-tenant or shared WordPress environments.
Technical ContextAI
The vulnerability is a classic CWE-89 (SQL Injection) caused by insufficient escaping of user-supplied input and failure to use parameterized/prepared SQL queries. The affected CPE is cpe:2.3:a:10web:form_maker_by_10web_-_mobile-friendly_drag_&_drop_contact_form_builder:*:*:*:*:*:*:*:*, confirming all releases of the 10Web Form Maker plugin are in scope. Source code references pinpoint vulnerable code at WDW_FM_Library.php lines 4682 and 4748, as well as admin/controllers/Generete_csv.php line 33 and form-maker.php line 873. These locations suggest the injection surfaces appear in both form group management logic and CSV export functionality. The 'groupids' parameter value is appended into existing SQL queries without adequate sanitization, allowing an attacker to inject arbitrary SQL clauses.
RemediationAI
A patch has been committed to the WordPress plugin repository per the referenced changeset (revision 3567408 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3567408%40form-maker&new=3567408%40form-maker), however the exact released patched version number is not independently confirmed from the available data - site administrators should update to the latest available version of Form Maker by 10Web beyond 1.15.43 via the WordPress dashboard and verify the installed version exceeds the last confirmed vulnerable release. As a compensating control pending upgrade, restrict WordPress administrator role assignments to the minimum necessary set of trusted users, reducing the attack surface for privilege abuse or account compromise. Additionally, deploying a WordPress-aware web application firewall (such as Wordfence or similar) with SQLi ruleset enabled can detect and block exploitation attempts against the 'groupids' parameter with minimal application-layer side effects.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today