EUVD-2026-37838
GHSA-h24f-c2f9-rj3m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator authentication mandates PR:H; read-only database extraction drives C:H with no integrity or availability impact warranting I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticated administrators to append arbitrary SQL clauses via the unsanitized 'name' parameter in the admin-side data selection interface, permitting full read access to the underlying WordPress database. The CVSS vector confirms a high confidentiality impact (C:H) but no integrity or availability impact, scoped exclusively to the vulnerable system. No active exploitation is confirmed (not listed in CISA KEV), no public POC has been identified at time of analysis, and the mandatory administrator-level authentication prerequisite substantially constrains real-world mass exploitation risk.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in SQL Commands) and resides in the admin-side data selection layer of the Form Maker by 10Web WordPress plugin (CPE: cpe:2.3:a:10web:form_maker_by_10web_-_mobile-friendly_drag_&_drop_contact_form_builder:*:*:*:*:*:*:*:*). The vulnerable code paths are specifically identified in the WordPress plugin repository at admin/models/FMSelectDataFromDb.php (lines 88 and 94) and admin/controllers/Select_data_from_db.php (line 84), with a related entry point at form-maker.php line 911. The root cause is string concatenation of user-supplied input into SQL query construction without adequate escaping or the use of WordPress's $wpdb->prepare() parameterized query mechanism. This classic unsanitized-input-to-query-string pattern allows appending additional SQL fragments - such as UNION SELECT or boolean-blind clauses - to queries that were otherwise syntactically valid, enabling data extraction from any table accessible to the WordPress database user.
RemediationAI
A patch commit has been applied to the WordPress plugin repository (changeset 3567408, available at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3567408%40form-maker&new=3567408%40form-maker), addressing the unsanitized 'name' parameter in FMSelectDataFromDb.php and Select_data_from_db.php. The exact released patched plugin version is not independently confirmed from available data; site administrators should update the Form Maker by 10Web plugin to any version released after 1.15.43 via the WordPress admin dashboard (Plugins > Updates) once a patched release is confirmed available. As compensating controls pending a confirmed patched release: enforce multi-factor authentication for all WordPress administrator accounts (reduces the risk that stolen credentials enable exploitation); apply a Web Application Firewall with SQL injection detection rules to the WordPress admin endpoint - note that admin-authenticated SQLi may bypass signature-based WAF rules depending on encoding, so this is a detection rather than prevention control; and audit all WordPress administrator accounts to enforce least-privilege, removing unnecessary admin roles. Database-level controls such as restricting the WordPress DB user to only the tables it requires can limit data exposure if exploitation occurs.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to in
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level at
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today