SQL Injection Vulnerability in Form Maker Plugin by 10Web for WordPress

CVE-2026-3330

What is CVE-2026-3330?

The Form Maker plugin by 10Web suffers from an SQL Injection vulnerability across all versions up to and including 1.15.40. The flaw originates from the improper handling of user inputs in the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters. Specifically, the WDW_FM_Library::validate_data() method inadequately processes the data by removing security protections set by WordPress, allowing for potential SQL query manipulation. This vulnerability permits authenticated users with Administrator privileges to inject malicious SQL queries that can retrieve sensitive database information. Furthermore, the Submissions controller's failure to enforce nonce checks for the 'display' task provides a means for Cross-Site Request Forgery (CSRF), enabling attackers to exploit the vulnerability through crafted links, thereby amplifying the risk to data integrity.

References