Form Maker 10Web CVE-2026-11777

Exploitation requires an active WordPress session authenticated at the administrator privilege level (PR:H per CVSS:3.1 vector) - subscriber, contributor, author, or editor roles are insufficient. The vulnerable code path is the plugin's admin-side database selection functionality, reachable only through the WordPress admin backend (/wp-admin/). No special plugin configuration or non-default feature flag is required beyond having the Form Maker by 10Web plugin installed and activated. What limits exploitation: (1) mandatory administrator authentication is the primary barrier - unauthenticated users and lower-privileged roles cannot reach the vulnerable endpoint; (2) the impact is read-only (C:H, I:N, A:N) - SQL injection here cannot modify or delete database records; (3) scope is unchanged (S:U), preventing OS-level command execution or cross-system pivoting; (4) the attack surface is the WordPress admin interface, which is commonly protected by IP allowlisting, MFA, or security plugins in hardened deployments.

The NVD CVSS base score of 4.9 is calibrated correctly for this vulnerability. The high privilege requirement (PR:H) is the dominant risk-limiting factor: only WordPress administrators - users who already possess extensive site control - can reach the vulnerable admin endpoint. No EPSS probability data was supplied, making quantitative exploitation likelihood assessment unavailable. The absence of a CISA KEV listing and the lack of any identified public POC code indicate no confirmed or widespread exploitation. The read-only impact profile (C:H, I:N, A:N) means exploitation enables sensitive data exfiltration - including hashed credentials, PII, and configuration data - but not direct database modification or system availability disruption. The unchanged scope (S:U) confirms exploitation is bounded to the WordPress database and does not provide lateral movement to the underlying OS or adjacent systems. In practical terms, this vulnerability is most relevant as a post-compromise escalation tool - an attacker who has already obtained admin credentials can use it to harvest additional database content - or as an insider threat vector. For organizations with strict admin account controls and MFA enforcement, real-world exploitability is low despite the theoretically network-reachable attack vector.

An attacker who has acquired WordPress administrator credentials - via phishing, credential stuffing against the wp-login.php endpoint, or lateral movement from another compromised account - authenticates to the WordPress admin panel and accesses the Form Maker plugin's admin data selection interface. The attacker submits a crafted 'name' parameter value containing SQL injection syntax (e.g., a UNION SELECT payload or time-based blind injection string) to the Select_data_from_db controller, causing the backend to execute the injected query against the WordPress database and return sensitive table contents such as wp_users hashed passwords, email addresses, or stored form submission data. No public POC code has been identified, but the vulnerability class is well understood and exploitation is mechanically straightforward for any attacker with admin-level access.