Blind SQL Injection in Form Maker by 10Web for WordPress

CVE-2026-95808

What is CVE-2026-95808?

The Form Maker plugin by 10Web is susceptible to a blind SQL injection vulnerability stemming from inadequate escaping of the 'inputs' parameter. This issue enables unauthenticated attackers to insert malicious SQL queries into the existing database queries, facilitating unauthorized access to sensitive information. The nonce, which should secure access to the vulnerable handler, is visible on every public page that renders a form, making it easily accessible for exploitation.

References