Executive brief
The Form Maker plugin, a popular WordPress tool for creating contact forms, contains a blind SQL injection flaw affecting its dynamic choice field feature. An authenticated attacker with subscriber-level access can manipulate database queries by crafting a malicious display name, potentially extracting sensitive data from the WordPress database without triggering visible errors.
Technical details
The vulnerability is a blind SQL injection in the fm_reload_input AJAX endpoint, caused by insufficient escaping of the {username} placeholder in the WHERE clause of DB-backed dynamic choice fields. An authenticated attacker first sets their WordPress profile's display_name to a SQL payload via the standard profile edit screen, then triggers the vulnerable endpoint to inject arbitrary SQL. This requires the form to be configured with a dynamic choice field whose WHERE template references {username}. The attacker can extract sensitive database information through blind SQL injection techniques without requiring administrator privileges.
Affected products
- 10Web Form Maker up to and including 1.15.44
Timeline
- 2026-08-15: disclosed