Executive brief
Form Maker by 10Web is a popular WordPress plugin used to create complex forms and map submission data to external databases. A security flaw in the plugin's MySQL Mapping feature allows attackers to execute unauthorized database commands. This could lead to the theft of sensitive information or disruption of the website's operations.
Technical details
The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection due to improper sanitization and preparation of SQL queries within the 'MySQL Mapping' feature. Specifically, when a form is configured to map inputs to a database table, the plugin fails to use parameterized queries for user-supplied input fields (e.g., using placeholders like {1}). An unauthenticated attacker can exploit this by submitting a crafted form entry containing SQL commands. If the mapping is active, the injected payload is executed against the database. This can be used to extract data via time-based blind techniques or modify database contents. The issue is fixed in version 1.15.38.
Affected products
- 10Web Form Maker by 10Web < 1.15.38
Timeline
- 2026-03-23: disclosed: Publicly published by WPScan
- 2026-04-13: advisory: NVD publication date