Form Maker by 10Web CVE-2026-39502

No special conditions - remote unauthenticated exploitation against default configurations of the Form Maker by 10Web WordPress plugin at any version ≤ 1.15.38 (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisites are network reachability to the WordPress site and the plugin being installed and active; no admin credentials, user interaction, or non-default settings are required. Limiting factors: the site must actually have the Form Maker plugin enabled (not merely installed/deactivated), and the vulnerable parameter is presumed to be reachable through a public form-rendering or AJAX endpoint rather than an admin-only screen - the exact entry point is not detailed in the supplied data and should be confirmed from the Patchstack advisory.

The signals point to a real, high-priority issue but with caveats. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N marks it as remotely exploitable with no auth or user interaction, and S:C/C:H reflects full confidentiality compromise - typical of SQLi that can read any database table including wp_users password hashes. However, I:N is notable: the vendor scoring asserts no integrity impact, which is unusual for SQLi and may indicate a read-only injection point (e.g., ORDER BY or a SELECT-only query) rather than UNION-based or stacked-query write capability. No EPSS, KEV, or POC data was supplied, so widespread automated exploitation is not yet evidenced; that said, WordPress plugin SQLi flaws historically attract mass scanning within days of Patchstack disclosure, so absence of POC today should not be interpreted as durable safety. Conflicting signal to flag: the 9.3 score is driven by S:C and C:H, but I:N moderates the realistic blast radius - defenders should still treat this as critical given the unauthenticated network vector.

An unauthenticated remote attacker scans WordPress sites running Form Maker by 10Web ≤ 1.15.38, identifies a vulnerable form-handling endpoint, and sends a crafted HTTP request with a malicious SQL payload in a form parameter. The injected query extracts sensitive data such as wp_users password hashes, wp_options secrets (including auth keys), and form submission contents, which the attacker then uses to crack credentials offline or pivot to full site takeover. No public exploit identified at time of analysis, but reproduction is typically trivial once a Patchstack advisory is published.