EUVD-2026-57962
GHSA-r5ww-xpj6-qqj5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Subscriber authentication required (PR:L); SQL injection typically permits data modification warranting I:L; scope change to database layer confirmed; no realistic availability impact justified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in Form Maker by 10Web <= 1.15.44 versions.
AnalysisAI
SQL injection in Form Maker by 10Web (WordPress plugin) versions 1.15.44 and earlier allows subscriber-level authenticated users to execute arbitrary SQL queries against the underlying database, achieving high confidentiality impact with scope change beyond the WordPress application boundary. The CVSS score of 8.5 reflects low-privilege exploitation with network access and no required user interaction, making this accessible to any registered WordPress user on an affected site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber account - the lowest role in the WordPress role hierarchy, which on many sites can be self-registered without administrator approval. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 score is well-justified by the combination of network accessibility, low attack complexity, subscriber-level authentication, and a scope change yielding high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker self-registers as a subscriber on a target WordPress site running Form Maker by 10Web 1.15.44 or earlier, then submits a crafted HTTP request to a form endpoint containing SQL injection payloads in a vulnerable parameter. The injected query executes with the application's database credentials, enabling extraction of sensitive data including the wp_users table (password hashes, email addresses) and potentially data from adjacent database schemas if the MySQL user has broader grants. |
| Remediation | Update Form Maker by 10Web to a version beyond 1.15.44; the exact patched release version was not explicitly stated in the available intelligence and must be confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/form-maker/vulnerability/wordpress-form-maker-by-10web-plugin-1-15-44-sql-injection-vulnerability or the WordPress plugin repository changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress sites for Form Maker plugin v1.15.44 or earlier and document affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Form Maker By 10Web
View allSecond-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-l
Unauthenticated SQL injection in the Form Maker by 10Web WordPress plugin (versions ≤ 1.15.38) allows remote attackers t
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today