SQL Injection Vulnerability in Form Maker by 10Web for WordPress

CVE-2026-3359

What is CVE-2026-3359?

The Form Maker by 10Web, a popular mobile-friendly contact form builder for WordPress, is impacted by a SQL Injection vulnerability. This flaw arises from insufficient escaping of the 'inputs' parameter, combined with inadequate preparation of the related SQL query. As a result, unauthenticated attackers can exploit this vulnerability to inject additional SQL statements, potentially allowing them to access sensitive data stored in the database. It is crucial for users of Form Maker to implement security measures and ensure they are using updated versions to mitigate risks.

References