Executive brief
Form Maker is a popular WordPress plugin used to create and manage complex forms on websites. A security flaw allows logged-in users with low-level access to run unauthorized database commands. This could lead to the theft of sensitive user information, modification of site content, or the elevation of the attacker's account to administrative status.
Technical details
The WordPress Form Maker plugin (v1.12.24 and below) is vulnerable to SQL injection via the 'admin-ajax.php' endpoint. The vulnerability exists within the 'FormMakerSQLMapping' and 'generete_csv' actions, specifically through the 'name' and 'search_labels' POST parameters. An authenticated attacker with access to plugin settings can inject malicious SQL code to bypass query logic. This can be exploited to extract sensitive data from the WordPress database, modify records, or achieve privilege escalation. A patch has been released by the vendor in versions following 1.12.24.
Affected products
- 10Web Form Maker <= 1.12.24
Timeline
- 2018-06-07: disclosed: Initial public exploit disclosure by DefenseCode
- 2018-06-07: patched: Vendor released update following contact
- 2026-05-23: advisory: CVE record published/updated in NVD