Form Maker 10Web CVE-2026-16977

Exploitation requires a subscriber-level (or higher) authenticated account on the target WordPress installation - any registered user qualifies, making open-registration sites particularly exposed. The attack is scoped to forms created with Form Maker by 10Web that specifically use the database-backed choice field type; standard text, email, or statically populated choice fields are not part of the vulnerable code path. The second-order injection mechanism requires two steps: first submitting the payload, then triggering the query that incorporates the stored value. Limiting factors are: (1) attacker must hold a valid WordPress account at subscriber level or above; (2) a form with a database-backed choice field must exist and be accessible; (3) the two-step nature prevents fully automated mass exploitation per SSVC's 'not automatable' designation. There is no requirement for admin-level access, no specific platform restriction, and no user-interaction dependency beyond the attacker's own form submission.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat profile: the attack is network-reachable, requires no elevated privileges beyond a subscriber account, and yields both high confidentiality and integrity compromise of the WordPress database. EPSS at 16% is substantially above the median for published CVEs, signaling real-world exploitation interest. The SSVC assessment corroborates this picture - exploitation status is 'poc' (not merely theoretical), technical impact is 'total', but automatable is 'no', consistent with the second-order nature requiring two distinct interaction steps. A public exploit from WPScan is confirmed available; this is distinct from confirmed active exploitation, which has not been established (no CISA KEV entry). The lack of automation potential slightly moderates risk compared to a fully scriptable mass-exploitation scenario, but does not negate it - targeted exploitation against specific high-value WordPress sites is plausible. Any WordPress installation accepting subscriber-level registrations and using database-backed choice fields in Form Maker forms should treat this as a priority remediation.

An attacker self-registers for a subscriber account on the target WordPress site, then navigates to a public-facing form built with Form Maker by 10Web that includes a database-backed choice field. The attacker submits a crafted SQL injection string as their input to that field; the payload is stored in the WordPress database. When the plugin subsequently constructs a dynamic SQL query incorporating the stored value - for example, when rendering form choices or processing a response - the injected SQL executes, and the attacker can extract hashed user credentials, private post content, or configuration data, or manipulate database records. A public proof-of-concept is available via WPScan, providing a ready-made exploitation template.