Junglewise Threat Intelligence

CVE-2026-15993: 10Web Form Maker blind SQL injection in dynamic choice field

CVE-2026-15993 · Severity: medium · CVSS 5.3 · Published 2026-08-15

Technologies: 10Web Form Maker. Vendors: 10Web.

Executive brief

The Form Maker plugin, a popular WordPress tool for creating contact forms, contains a blind SQL injection flaw affecting its dynamic choice field feature. An authenticated attacker with subscriber-level access can manipulate database queries by crafting a malicious display name, potentially extracting sensitive data from the WordPress database without triggering visible errors.

Technical details

The vulnerability is a blind SQL injection in the fm_reload_input AJAX endpoint, caused by insufficient escaping of the {username} placeholder in the WHERE clause of DB-backed dynamic choice fields. An authenticated attacker first sets their WordPress profile's display_name to a SQL payload via the standard profile edit screen, then triggers the vulnerable endpoint to inject arbitrary SQL. This requires the form to be configured with a dynamic choice field whose WHERE template references {username}. The attacker can extract sensitive database information through blind SQL injection techniques without requiring administrator privileges.

Affected products

  • 10Web Form Maker up to and including 1.15.44

Timeline

  • 2026-08-15: disclosed

References

Related threats