Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder
CVE-2026-3330
|
EUVD-2026-23352
MEDIUM
GHSA-88f4-qv6h-wgph
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including, 1.15.40. This is due to the WDW_FM_Library::validate_data() method calling stripslashes() on user input (removing WordPress's wp_magic_quotes() protection) and the FMModelSubmissions_fm::get_labels_parameters() function directly concatenating user-supplied values into SQL queries without using $wpdb->prepare(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the display task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.
AnalysisAI
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract sensitive database information via unsanitized parameters (ip_search, startdate, enddate, username_search, useremail_search) in the Submissions display function. The vulnerability stems from the validate_data() method stripping WordPress's magic quotes protection and get_labels_parameters() concatenating user input directly into SQL queries without prepared statements. A CSRF vector exists because the vulnerable display task lacks nonce verification, enabling attackers to trick administrators into triggering the injection via a crafted link. Exploitation requires Administrator-level privileges but can be chained with CSRF for unauthorized triggering.
Technical ContextAI
The Form Maker by 10Web plugin mishandles user input in two critical locations: the WDW_FM_Library::validate_data() method calls stripslashes() on user-supplied values, explicitly removing WordPress's wp_magic_quotes() protection mechanism designed to prevent SQL injection. Subsequently, the FMModelSubmissions_fm::get_labels_parameters() function concatenates these unsanitized values directly into SQL queries without using the WordPress $wpdb->prepare() prepared statement API (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The vulnerable parameters (ip_search, startdate, enddate, username_search, useremail_search) are processed through this chain when the Submissions controller handles the display task. Critically, the Submissions_fm controller omits nonce verification (wp_verify_nonce) for the display task action, creating a secondary CSRF vulnerability that allows remote attackers to trigger the SQL injection by manipulating an authenticated administrator into clicking a malicious link. This combination violates WordPress security best practices: input sanitization, parameterized queries, and CSRF tokens.
RemediationAI
Update Form Maker by 10Web to version 1.15.41 or later immediately, as the vulnerability affects all versions through 1.15.40. The patch must address three components: (1) removal of the stripslashes() call in WDW_FM_Library::validate_data() to preserve WordPress's native magic quotes protection, (2) refactoring FMModelSubmissions_fm::get_labels_parameters() to use $wpdb->prepare() for all SQL queries, and (3) adding wp_verify_nonce() validation to the Submissions controller's display task to prevent CSRF exploitation. Administrators should verify the patch is applied by checking the plugin version in the WordPress admin dashboard (Plugins > Installed Plugins) or via the plugin's code repository. Until patching, mitigate the CSRF vector by disabling the display task endpoint if not actively used (requires custom code modification) or by restricting Administrator role to only essential personnel. Do not rely on WAF rules alone, as SQL injection may evade basic signature detection when obfuscated via CSRF payloads. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5e383b8a-27e5-4b35-8d11-6e4102255d44?source=cve for vendor confirmation and patch release timeline.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to in
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subsc
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level at
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today