CVE-2026-11777: Form Maker by 10Web SQL Injection Vulnerability

Technical summary

CVE-2026-11777 is a SQL injection vulnerability (CWE-89) in Form Maker by 10Web versions ≤1.15.43. The plugin fails to properly escape user input in the 'name' parameter and does not use prepared statements, allowing authenticated high-privilege users to append arbitrary SQL commands to existing queries. The attack vector is network-based with low complexity, and while it requires administrator-level credentials, it provides confidentiality impact through unauthorized data extraction.

Business impact

Organizations running Form Maker on WordPress sites face potential exposure of sensitive database contents, including user data, email addresses, and other stored information accessible through the form's database tables. The risk is primarily to data confidentiality rather than availability or integrity. Since exploitation requires administrator credentials, the threat comes from insider actors or compromised admin accounts. The severity depends on the sensitivity of data stored in affected WordPress databases and integration with other business systems.

Affected systems

WordPress installations using the Form Maker by 10Web plugin in any version up to and including 1.15.43. The plugin is a drag-and-drop form builder used for creating contact forms and other interactive form elements. Any WordPress site with this plugin installed and an admin account is potentially at risk if that account is compromised or controlled by a malicious insider.

Exploitability

Exploitation requires authenticated access with administrator-level privileges, significantly limiting practical attack scenarios. An attacker cannot exploit this remotely without valid WordPress admin credentials. The attack is straightforward once privileged access exists—the 'name' parameter accepts injected SQL syntax due to insufficient input sanitization. The CVSS score of 4.9 (Medium) reflects the high privilege requirement offsetting the high confidentiality impact. This is not an unauthenticated, easy-to-exploit vulnerability, but represents a real risk in environments with compromised or untrusted admin accounts.

Remediation

Update the Form Maker by 10Web plugin to a patched version released after 1.15.43. Verify the exact patched version against the vendor's security advisory. Additionally, review WordPress administrator access controls—restrict admin roles to necessary personnel, enforce strong passwords, enable multi-factor authentication, and monitor admin activities for suspicious database queries or form modifications.

Patch guidance

Check the official 10Web plugin repository and security advisories for the released patch version. Update through WordPress's plugin management interface once a fix is available. Test the update in a staging environment to ensure form functionality remains intact. After patching, audit recent database activity logs if available to detect any malicious queries that may have been executed. Verify patch application by confirming the plugin version in WordPress settings matches the patched version.

Detection guidance

Monitor WordPress admin access logs for unusual login patterns or accounts. Examine WordPress database query logs (if enabled) for suspicious SQL syntax in the form_maker plugin operations, particularly queries containing UNION, SELECT FROM, or other injected SQL keywords appearing in the 'name' parameter. Use Web Application Firewalls (WAF) to detect SQL injection patterns. Review form submissions for abnormal 'name' field values containing SQL syntax. Consider using WordPress security plugins that log and alert on database query anomalies.

Why prioritize this

While the CVSS score is Medium (4.9), the vulnerability should be prioritized for patching due to its direct impact on database confidentiality and the potential for lateral movement once a database is compromised. Prioritize based on: (1) whether administrator accounts are well-protected with MFA, (2) the sensitivity of data stored in the WordPress database, and (3) whether the plugin actively receives form submissions. Organizations with strong admin access controls can defer patching slightly longer than those with weaker privilege management.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a Medium severity rating based on network accessibility (AV:N), low attack complexity (AC:L), and high privileges required (PR:H). The score emphasizes high confidentiality impact (C:H) but no integrity or availability impact. The privilege requirement significantly reduces the exploitability rating. Organizations should not dismiss this as low-risk; the ability to extract sensitive database contents is serious, but the admin-level prerequisite prevents widespread automated exploitation.

Frequently asked questions