Form Maker by 10Web EUVD-2026-27240

No special conditions required for exploitation - this is remote unauthenticated access against default plugin configurations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with low complexity and no privilege or user interaction requirements. Any WordPress site with Form Maker by 10Web version 1.15.42 or earlier installed and activated is vulnerable, regardless of how the plugin is configured or which forms are published. The vulnerability exists in the plugin's form processing logic which handles the 'inputs' parameter from HTTP requests, a core function that cannot be disabled without deactivating the entire plugin. Exploitation is limited only by network reachability: public-facing WordPress sites are immediately exploitable from the internet, while internal sites require attacker access to the network perimeter. The plugin does not need to have any forms actively published - the vulnerable code path is accessible as long as the plugin is activated in WordPress.

This vulnerability presents significant real-world risk despite no confirmed active exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the worst-case attack scenario: network-accessible, low complexity, requiring no authentication or user interaction. The C:H (high confidentiality impact) reflects the ability to extract arbitrary database contents. However, the I:N/A:N (no integrity or availability impact) means attackers cannot modify data or cause denial of service through this vector alone - limiting real-world weaponization to reconnaissance and credential harvesting phases of multi-stage attacks. The vulnerability is in a popular WordPress plugin (form builders are common targets with wide installation bases), increasing the attack surface. Without EPSS data, we cannot quantify exploitation probability, but the combination of unauthenticated remote access and availability of a public patch (which serves as a roadmap for exploit development) suggests moderate-to-high risk for unpatched installations. The Wordfence disclosure and Trac commit provide clear remediation paths, likely prompting attackers to reverse-engineer the fix. SSVC assessment: exploitation status unknown, automatable (yes - SQL injection can be scripted), technical impact partial (confidentiality only). Priority should be HIGH for public-facing WordPress sites, MEDIUM for internal/development sites with additional perimeter controls.

An unauthenticated attacker identifies a WordPress site running Form Maker by 10Web through plugin fingerprinting (checking for characteristic JavaScript/CSS files or form markup). The attacker crafts an HTTP POST request to the form processing endpoint with a malicious 'inputs' parameter containing SQL injection payload such as: inputs=' UNION SELECT user_login,user_pass,user_email FROM wp_users--. The vulnerable plugin concatenates this input directly into a SQL query without sanitization. The resulting query extracts WordPress administrator usernames, password hashes, and email addresses from the wp_users table. The attacker then uses offline hash cracking tools against the bcrypt hashes to recover plaintext credentials, enabling full WordPress site compromise through legitimate admin login.