Executive brief
Form Maker by 10Web is a popular WordPress plugin that allows site administrators to build and deploy contact forms, surveys, and data collection forms. Before version 1.15.45, a second-order SQL injection vulnerability allows any subscriber-level user to extract sensitive database information by poisoning their own display name with SQL payloads, which are then executed when the form with MySQL Mapping is viewed. This could lead to unauthorized access to user credentials, email addresses, and other sensitive data stored in the WordPress database.
Technical details
The vulnerability is a second-order SQL injection (CWE-89) in the MySQL Mapping feature of Form Maker. When a form field uses the MySQL Mapping data source, user-controlled values (specifically the viewer's display_name) are substituted directly into a dynamic SQL WHERE clause without proper parameterization or escaping. An attacker with subscriber-level privileges can set their display_name to a SQL injection payload (e.g., x' OR SLEEP(5)='). When another user views a form containing a MySQL-mapped field, the attacker's payload is pulled from the database and executed unescaped in the query, allowing boolean-blind SQL injection to exfiltrate data row-by-row via timing side-channels or conditional logic. The vulnerability requires non-default admin configuration (MySQL Mapping enabled) and user interaction (loading the form page). Version 1.15.45 fixes this by properly parameterizing the display_name value, binding it as an escaped literal rather than injecting it as query structure.
Affected products
- 10Web Form Maker before 1.15.45
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Version 1.15.45 released with fix