What is the CVSS score of CVE-2026-3359?

CVE-2026-3359 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Form Maker by 10Web are affected by CVE-2026-3359?

Form Maker by 10Web plugin (versions through 1.15.42) contains an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive database contents including user credentials…

How to fix or mitigate CVE-2026-3359?

Within 24 hours: Identify all WordPress installations running Form Maker by 10Web and document current plugin versions via admin dashboard or site inventory. Within 7 days: Update Form Maker by 10Web to version 1.15.43 or later on all affected WordPress instances; test functionality in staging environment before production deployment. Within 30 days: Conduct audit of form submission logs and user account activities for suspicious access patterns between plugin installation and patch date; reset credentials for users who submitted forms through affected plugin instances.

Form Maker by 10Web CVE-2026-3359

EUVD-2026-27240 HIGH

SQL Injection (CWE-89)

2026-05-05 Wordfence

GHSA-qv7x-qxqg-p2wh

WordPress SQLi Form Maker By 10Web Mobile Friendly Drag Drop Contact Form Builder Wordpress Plugin 10Web

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 09:00 vuln.today

DescriptionCVE.org

The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database contents including user credentials, form submissions, and WordPress configuration data. The vulnerability affects all versions through 1.15.42 and requires no special configuration - any WordPress site running the plugin with default settings is exploitable. CVSS 7.5 (High) reflects network-based unauthenticated access with high confidentiality impact. EPSS data not provided; no CISA KEV listing identified, indicating no confirmed widespread exploitation at time of analysis. Patch available in version 1.15.43 per Trac changeset 3518461.

Technical ContextAI

This is a classic unsanitized SQL injection vulnerability (CWE-89) in a WordPress plugin. The 'inputs' parameter received by the plugin lacks proper escaping and parameterized query preparation, allowing attackers to inject arbitrary SQL commands into existing database queries. WordPress plugins interact directly with the MySQL/MariaDB backend through the WordPress database abstraction layer (wpdb). When user-supplied data from HTTP parameters is concatenated into SQL strings without sanitization or parameterized queries, attackers can break out of the intended query context and execute their own SQL commands. The affected product is specifically the Form Maker by 10Web plugin (CPE: cpe:2.3:a:10web:form_maker_by_10web), a drag-and-drop contact form builder with mobile-friendly features. SQL injection vulnerabilities in WordPress plugins are particularly dangerous because the WordPress database contains password hashes, email addresses, post content, plugin configuration data, and potentially sensitive form submission data - all accessible through a single database connection with the wordpress user's privileges.

RemediationAI

Upgrade Form Maker by 10Web plugin to version 1.15.43 or later immediately. The patch implements proper SQL query parameterization and input sanitization for the 'inputs' parameter, as documented in WordPress Trac changeset 3518461 (https://plugins.trac.wordpress.org/changeset/3518461/form-maker). Update through the WordPress admin dashboard (Plugins → Installed Plugins → Form Maker → Update Now) or download directly from the WordPress plugin repository. If immediate patching is not feasible, implement these compensating controls: (1) Deploy a Web Application Firewall (WAF) with SQL injection signatures targeting the 'inputs' parameter - note this may break legitimate form submission functionality and requires testing; (2) Restrict WordPress admin access (/wp-admin/) to trusted IP ranges via .htaccess or network firewall, though this does not protect the vulnerable frontend form processing endpoints; (3) Enable WordPress audit logging (via plugins like WP Security Audit Log) to detect anomalous database queries, though this provides detection not prevention; (4) As a last resort, temporarily deactivate the Form Maker plugin until patching is possible, which will break existing forms but eliminates the attack surface. All compensating controls are inferior to patching and should be considered temporary measures only.