EUVD-2026-37842
GHSA-m85c-v3hh-52xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress administrator credentials
-
DeliveryAuthenticate to WordPress admin panel
-
ExploitSubmit crafted 'groupids' payload to vulnerable form group or CSV export endpoint
-
ExecutionInject appended SQL into existing query
-
ImpactExtract sensitive rows from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active, authenticated WordPress session with administrator-level privileges or higher (PR:H per CVSS). The vulnerability is triggered via the 'groupids' parameter, which is processed in form group management and CSV export admin functionality within the plugin - meaning the Form Maker plugin must be installed and active on the target WordPress site. No special non-default WordPress configuration is required beyond the plugin being present. Exploitation is limited by the administrator authentication prerequisite: unauthenticated attackers and lower-privileged roles (Subscriber, Editor, Author, Contributor) cannot reach the vulnerable code path. The scope is unchanged (S:U), meaning the injection impact is confined to the WordPress database accessible to the existing database user - lateral movement to the OS or other databases is not indicated. |
| Impact | The CVSS 3.1 base score of 4.9 reflects the administrator privilege requirement (PR:H), which substantially reduces exploitability compared to unauthenticated SQL injection findings. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms network accessibility with low complexity once admin access is held, and a high confidentiality impact - the attacker can extract arbitrary data from the WordPress database, potentially including credentials, PII, and configuration secrets. Integrity and availability are not impacted per the CVSS assessment, aligning with the read-only nature of the described injection. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, suggesting no observed active exploitation. No public proof-of-concept code was identified in the available data. The realistic threat is primarily an insider threat, a compromised admin account, or an attacker who has escalated privileges within WordPress - all meaningful but not broadly opportunistic attack surfaces. |
| Exploit ScenarioDerived | An attacker who has gained WordPress administrator credentials - through phishing, credential stuffing, or internal privilege abuse - navigates to an admin panel feature that processes the 'groupids' parameter (such as form group management or CSV export). By appending SQL syntax to the 'groupids' value, the attacker injects a UNION-based or boolean-based SQL clause into the existing query, enabling extraction of arbitrary rows from the WordPress database including wp_users password hashes, plugin configuration data, or stored form submission content. No public proof-of-concept code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level attackers via the unsanitized 'groupids' parameter. All plugin versions through 1.15.43 are affected across multiple code paths in WDW_FM_Library.php and Generete_csv.php. No active exploitation is confirmed (not in CISA KEV), and exploitation is constrained by the administrator privilege requirement, though the high confidentiality impact from unrestricted database read access remains a meaningful concern for multi-tenant or shared WordPress environments.
RemediationAI
A patch has been committed to the WordPress plugin repository per the referenced changeset (revision 3567408 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3567408%40form-maker&new=3567408%40form-maker), however the exact released patched version number is not independently confirmed from the available data - site administrators should update to the latest available version of Form Maker by 10Web beyond 1.15.43 via the WordPress dashboard and verify the installed version exceeds the last confirmed vulnerable release. As a compensating control pending upgrade, restrict WordPress administrator role assignments to the minimum necessary set of trusted users, reducing the attack surface for privilege abuse or account compromise. Additionally, deploying a WordPress-aware web application firewall (such as Wordfence or similar) with SQLi ruleset enabled can detect and block exploitation attempts against the 'groupids' parameter with minimal application-layer side effects.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 (SQL Injection) caused by insufficient escaping of user-supplied input and failure to use parameterized/prepared SQL queries. The affected CPE is cpe:2.3:a:10web:form_maker_by_10web_-_mobile-friendly_drag_&_drop_contact_form_builder:*:*:*:*:*:*:*:*, confirming all releases of the 10Web Form Maker plugin are in scope. Source code references pinpoint vulnerable code at WDW_FM_Library.php lines 4682 and 4748, as well as admin/controllers/Generete_csv.php line 33 and form-maker.php line 873. These locations suggest the injection surfaces appear in both form group management logic and CSV export functionality. The 'groupids' parameter value is appended into existing SQL queries without adequate sanitization, allowing an attacker to inject arbitrary SQL clauses.
Know when Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Plugin is network-accessible via WordPress admin; administrator authentication required (PR:H); read-only database extraction means C:H with I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthentic
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attack
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48)
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to in
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract
Exploit-DB