CVE-2026-11776: SQL Injection in Form Maker by 10Web WordPress Plugin

Technical summary

This vulnerability is a classic SQL injection flaw (CWE-89) stemming from insufficient input validation and lack of prepared statement use. The 'groupids' parameter is not properly escaped before being incorporated into SQL queries, allowing authenticated admins to append arbitrary SQL commands. The attack surface is limited to users with administrator privileges or higher, but once compromised, an attacker gains read access to the entire WordPress database including user credentials, configuration data, and sensitive plugin/theme information.

Business impact

While the vulnerability requires administrative access to trigger, a compromised admin account—whether through phishing, credential reuse, or insider threat—becomes a direct path to database exfiltration. Organizations relying on Form Maker for lead capture or customer data collection face potential exposure of personal information collected through forms, alongside broader database compromise. This could trigger compliance incidents under GDPR, CCPA, and similar regulations if customer data is extracted.

Affected systems

Any WordPress installation running Form Maker by 10Web plugin version 1.15.43 or earlier is affected. The plugin is broadly distributed in the WordPress ecosystem, making this a widespread threat across small business, enterprise, and agency deployments that use this form builder for client-facing contact forms or lead generation workflows.

Exploitability

Exploitation requires valid WordPress administrator credentials and direct access to the affected parameter within the plugin's functionality. The technical barrier is low—SQL injection is straightforward once inside the admin panel—but the authentication requirement significantly constrains real-world attack scenarios. Opportunistic attacks are unlikely; targeted compromise of an admin account would be the prerequisite.

Remediation

Update Form Maker by 10Web to a patched version released after June 18, 2026. Verify the patch version against the vendor's official security advisory to ensure the 'groupids' parameter validation and prepared statement implementation are included. Until patching is complete, restrict admin account access to trusted users only and enforce strong password policies and multi-factor authentication for all administrator accounts.

Patch guidance

Monitor the 10Web security advisories and WordPress plugin repository for a patched release. Apply updates immediately upon availability, as even the authentication gate does not justify prolonged exposure in high-risk environments. Test patched versions in a staging environment first to ensure no form functionality regressions. If automatic updates are enabled, verify that the plugin updates without manual intervention.

Detection guidance

Monitor WordPress database logs and web server access logs for suspicious SQL patterns in requests to the plugin's admin endpoints, particularly POST requests containing unusual characters (single quotes, semicolons, UNION keywords) in the 'groupids' parameter. Implement WordPress-level logging via security plugins to track changes to user accounts or database queries initiated by admin-level actions. Check database audit logs for unexpected SELECT queries or data export patterns following login from unfamiliar IPs.

Why prioritize this

Although rated MEDIUM (CVSS 4.9) and requiring admin credentials, this vulnerability should be prioritized based on your organization's admin account security posture. In environments with weak admin account hygiene, credential sharing, or frequent third-party vendor access, patch immediately. Organizations with strong MFA, limited admin role assignments, and monitoring can defer slightly but should not postpone beyond the next maintenance window.

Risk score, explained

The CVSS 4.9 MEDIUM score reflects the high privilege requirement (PR:H) and limited impact scope (Confidentiality High, but Integrity and Availability unaffected). However, the contextual severity depends on the value and sensitivity of data stored in your WordPress database and the tightness of your admin access controls. A plugin with strict admin-only functionality and limited user base reduces real-world risk; broader admin delegation or shared credentials elevates it significantly.

Frequently asked questions