Description

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-15T04:18:09.727Z",
  "pubdate": "2026-08-15T04:18:09.727Z",
  "executiveSummary": "The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is susceptible to a blind SQL Injection vulnerability. This security flaw exists in all versions up to, and including, 1.15.44 and arises from the improper handling of the {username} placeholder within the WHERE clause of dynamic-choice fields. The vulnerability allows authenticated attackers with subscriber-level privileges or higher to manipulate existing database queries, potentially leading to the extraction of sensitive database information. Successful exploitation requires specific pre-conditions, including the configuration of a form utilizing a database-backed dynamic choice field that references the {username} placeholder. An attacker must first update their user display_name profile parameter to incorporate a malicious SQL injection payload via standard WordPress profile management features. Subsequent triggering of the fm_reload_input AJAX endpoint executes the contaminated query. The primary risk involves unauthorized data exfiltration from the underlying WordPress database by low-privileged authenticated users.",
  "technicalDetails": "The vulnerability is classified as a blind SQL Injection affecting the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress across all versions up to, and including, 1.15.44. The root cause of the flaw stems from insufficient escaping and sanitization applied to user-supplied parameters, compounded by a lack of proper query preparation mechanisms within the existing SQL query construction logic. Specifically, the vulnerability manifests within the handling of the {username} placeholder utilized inside the WHERE clause of database-backed dynamic-choice fields. Privilege requirements dictate that the attacker must possess authenticated access with subscriber-level permissions or higher. The attack vector leverages standard WordPress functionality and specific AJAX endpoints exposed by the plugin. The attack flow initiates when an authenticated attacker navigates to the standard WordPress profile edit screen. The attacker modifies their own display_name parameter to incorporate a crafted SQL injection payload. Following this profile modification, the attacker triggers the fm_reload_input AJAX endpoint associated with the plugin. When the server processes a form configured with a database-backed dynamic choice field whose WHERE template references the {username} placeholder, it substitutes the placeholder with the attacker-controlled display_name value without adequate escaping or parameterization. This unsanitized input is concatenated directly into the active database query. Because the application handles the interaction in a blind context, the payload behavior enables attackers to infer database contents by observing application responses or timing variations following the execution of appended SQL queries. The resulting post-exploitation impact includes unauthorized data exfiltration, enabling attackers with low-level subscriber privileges to extract sensitive information from the underlying database."
}