Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder CVE-2026-3330

Exploitation requires Administrator-level or higher WordPress user role; the vulnerability is strictly limited to authenticated attackers with 'manage_options' capability or equivalent. The vulnerable 'display' task in the Submissions controller must be accessible (enabled by default in active Form Maker installations). The CSRF variant bypasses the authentication requirement via social engineering-an attacker tricks an already-logged-in administrator into clicking a malicious link, allowing the SQL injection to execute in the administrator's session context without the attacker holding credentials. No special plugin configuration is required; the vulnerability exists in the default installation. The vulnerability is NOT exploitable by unauthenticated visitors or lower-privileged WordPress roles (Contributor, Editor, Subscriber). The stripslashes() call in validate_data() affects only requests that pass through the WDW_FM_Library validation chain; direct database queries may bypass this if the plugin has other entry points. Exploitation is limited by the INFORMATION_SCHEMA permissions of the WordPress database user-typically WordPress database users have SELECT privileges on all tables, making data extraction feasible, but INSERT/UPDATE/DELETE operations may be restricted depending on the database user's role.

This vulnerability presents moderate real-world risk despite its 4.9 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) correctly reflects that exploitation requires high privileges (Administrator role) and network access, limiting the attacker pool to trusted site personnel or accounts compromised through other means. However, the CSRF component significantly amplifies risk: while CVSS doesn't account for social engineering, a CSRF-enabled SQL injection can be weaponized against administrators who lack security awareness. The information disclosure impact (C:H) is confirmed-attackers can extract database contents, potentially including user credentials, private form submissions, and sensitive business data. The lack of integrity/availability impact (I:N/A:N) suggests this is a reconnaissance tool rather than a data destruction vector. From an SSVC perspective: the exploitation status is unconfirmed (no KEV listing, no public POC identified), the attack is automatable once triggered, and the technical impact is high (data breach of sensitive information). The critical missing piece is whether this is exploited in the wild-the moderate CVSS combined with high barrier to entry (Administrator access required) suggests this may be exploited opportunistically by insiders or via compromised admin accounts rather than as a widespread attack vector. Organizations with tight access controls on Administrator roles face lower risk; those with delegated form management access face higher risk. The CSRF vector transforms a high-privilege attack into a medium-privilege attack if an attacker can social-engineer a site administrator.

An attacker with compromised Administrator credentials (or an insider with Admin access) logs into the WordPress dashboard and navigates to the Form Maker Submissions page, then appends a malicious SQL injection payload to the ip_search or username_search parameter (e.g., ?page=form_maker&view=Submissions&display=1&ip_search=1' UNION SELECT user_login,user_pass FROM wp_users WHERE '1'='1). Because validate_data() strips quote escaping and get_labels_parameters() concatenates the parameter directly into the SQL query without prepared statements, the injected SQL executes and extracts WordPress user credentials or other sensitive data. Alternatively, an attacker crafts a CSRF link containing the malicious payload and tricks a site administrator into clicking it while logged in; the Submissions controller's missing nonce check allows the injection to execute without the administrator's knowledge, exfiltrating data to an attacker-controlled server via a second-stage UNION query that outputs results to a log or external endpoint.