SQL Injection Vulnerability in Form Maker Plugin by 10Web
CVE-2026-16977
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16977?
The Form Maker plugin by 10Web for WordPress prior to version 1.15.45 contains a vulnerability due to improper parameterization of user-controlled values. This flaw allows an attacker with subscriber-level permissions to exploit dynamic SQL queries within the plugin, potentially enabling second-order SQL injection attacks. Such vulnerabilities can compromise database integrity and allow unauthorized data manipulation.
Affected Version(s)
Form Maker by 10Web 0 < 1.15.45
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.