10Web Form Maker EUVD-2026-100797

Exploitation requires that the target site have the 10Web Form Maker plugin (version ≤1.15.48) installed and at least one of its forms rendered on a publicly accessible page - this is the realistic default usage of a contact-form plugin. The only procedural prerequisite, a valid nonce reaching the vulnerable handler, is not a meaningful barrier because the description confirms the nonce is emitted to every public page that renders a form, making it obtainable from page source without authentication. There is no required user interaction, no authentication, and no non-default configuration needed; the practical limiting factor is simply that a Form Maker form must be publicly exposed on the site.

This is a genuinely high-priority issue, not an inflated-CVSS artifact. All available signals align: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no authentication, and the description reinforces this by noting the nonce guarding the vulnerable handler is emitted into the public page source of any page rendering a form - so the one apparent gating factor (nonce validation) is trivially defeated by an unauthenticated attacker, justifying AC:L rather than AC:H. The impact is scoped to confidentiality only (C:H/I:N/A:N), consistent with a blind SQL injection used to exfiltrate database contents (WordPress user hashes, secrets) rather than modify data or crash the service. No EPSS score was supplied, there is no CISA KEV listing, and no public proof-of-concept is referenced, so real-world exploitation volume cannot be quantified from the input - the risk rating here is driven by exploitability characteristics and the low barrier to weaponization of an unauthenticated SQLi in a WordPress plugin, a class historically targeted by automated mass-scanning once details are public. No signals conflict; the main missing data is EPSS and any exploitation telemetry.

An unauthenticated attacker visits any public page of the target site that renders a 10Web Form Maker form, scrapes the exposed nonce from the page source, and submits a crafted request to the vulnerable form handler with SQL payloads in the 'inputs' parameter. Because the query is neither escaped nor prepared, the injected clauses execute blind against the database, letting the attacker iteratively extract sensitive data such as WordPress administrator password hashes. No public exploit code is identified at time of analysis, but the technique is straightforward to automate.