Executive brief
The Form Maker plugin for WordPress, which allows users to create contact forms, contains a security flaw that could allow an authorized administrator to access sensitive information from the website's database. By exploiting this vulnerability, an attacker with high-level access could run unauthorized database queries to extract data they are not supposed to see. This could lead to the exposure of customer information or internal site configurations.
Technical details
The Form Maker by 10Web plugin for WordPress is vulnerable to a generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43. This is due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query within the plugin's code. An authenticated attacker with administrator-level privileges can exploit this by appending malicious SQL commands to existing queries. This allows for the extraction of sensitive data from the WordPress database. The vulnerability is tracked as CWE-89 and requires network access with high privileges.
Affected products
- 10Web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder up to, and including, 1.15.43
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.41/admin/controllers/Generete_csv.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.41/form-maker.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.41/framework/WDW_FM_Library.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.41/framework/WDW_FM_Library.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.43/admin/controllers/Generete_csv.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.43/form-maker.php
- https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.43/framework/WDW_FM_Library.php