EUVD-2026-57091
GHSA-h2c2-45p9-4958
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable via web form; subscriber auth sufficient (PR:L); second-order timing does not elevate complexity given available POC; no availability impact described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
AnalysisAI
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a subscriber-level (or higher) authenticated account on the target WordPress installation - any registered user qualifies, making open-registration sites particularly exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat profile: the attack is network-reachable, requires no elevated privileges beyond a subscriber account, and yields both high confidentiality and integrity compromise of the WordPress database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker self-registers for a subscriber account on the target WordPress site, then navigates to a public-facing form built with Form Maker by 10Web that includes a database-backed choice field. The attacker submits a crafted SQL injection string as their input to that field; the payload is stored in the WordPress database. … |
| Remediation | Upgrade Form Maker by 10Web to version 1.15.45 or later, which contains the vendor-released patch addressing improper SQL parameterization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress sites running Form Maker versions prior to 1.15.45 and restrict subscriber-level access to form submissions as an interim control. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Form Maker By 10Web
View allUnauthenticated SQL injection in the Form Maker by 10Web WordPress plugin (versions ≤ 1.15.38) allows remote attackers t
SQL injection in Form Maker by 10Web (WordPress plugin) versions 1.15.44 and earlier allows subscriber-level authenticat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today