EUVD-2026-58857
GHSA-6pwj-j8g4-g6fg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Subscriber authentication (PR:L) and mandatory non-default {username} WHERE config (AC:H) gate access; blind SQLi yields read-only database impact (C:H, I:N, A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
AnalysisAI
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
Technical ContextAI
The affected product is the Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin (CPE: cpe:2.3:a:10web:form_maker_by_10web_-_mobile-friendly_drag_&_drop_contact_form_builder:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: the plugin constructs SQL WHERE clauses for database-backed dynamic choice fields by interpolating the WordPress {username} placeholder directly from user-controlled profile data without adequate escaping or use of parameterized (prepared) statements. Vulnerable code is confirmed in WDW_FM_Library.php at lines 6657 and 6147, frontend/views/form_maker.php at line 2849, and frontend/controllers/form_maker.php at line 252 across both the 1.15.43 and 1.15.44 tagged releases in the WordPress plugin repository. The exploitable trigger is the fm_reload_input AJAX endpoint, which re-evaluates the dynamic choice field query using the attacker's display_name as the {username} substitution value.
RemediationAI
Update the Form Maker by 10Web plugin to a version beyond 1.15.44 - a remediation commit is confirmed in the WordPress plugin repository at changeset 3632835 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3632835%40form-maker&new=3632835%40form-maker), though the specific patched release version number has not been independently confirmed from the available data; verify the current version in the WordPress plugin directory before upgrading. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1665bf5a-3bf0-4907-a7df-a2fe26f11869 should be consulted for a confirmed patched version once published. As a compensating control prior to patching, audit all forms for use of DB-backed dynamic choice fields and remove or replace any WHERE clause templates that reference the {username} placeholder - this directly neutralizes the injection vector with no functional loss for forms that do not require that placeholder. Additionally, disabling open subscriber registration (WordPress Settings > General > Membership) eliminates the PR:L attack surface entirely if subscriber accounts are not a site requirement, though this may affect site functionality for membership-based deployments.
Unauthenticated SQL injection in Form Maker by 10Web plugin allows remote attackers to extract sensitive database conten
Stored Cross-Site Scripting in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows unauthenticated attackers
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to in
SQL injection in the Form Maker by 10Web WordPress plugin exposes the WordPress database to authenticated admin-level at
SQL Injection in the Form Maker by 10Web WordPress plugin (all versions up to and including 1.15.43) enables authenticat
SQL injection in Form Maker by 10Web WordPress plugin (versions ≤1.15.40) allows authenticated administrators to extract
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today