Description

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T06:19:18.193Z",
  "pubdate": "2026-08-12T06:19:18.193Z",
  "executiveSummary": "A second-order SQL injection vulnerability has been identified in the Form Maker by 10Web WordPress plugin. This security flaw arises due to the improper parameterization of user-controlled input that is subsequently incorporated into a dynamic SQL query constructed for a database-backed choice field. The vulnerability exposes the underlying database to manipulation and unauthorized data extraction.\nSubscriber-level users possessing authenticated access can leverage this capability to execute arbitrary SQL commands. Successful exploitation requires the attacker to inject malicious payloads that are stored and later evaluated when the dynamic SQL query is executed by the application. The impact includes potential compromise of confidentiality, integrity, and availability of the database repository backing the WordPress installation.",
  "technicalDetails": "The vulnerability is rooted in the database-backed choice field component of the Form Maker by 10Web plugin, specifically affecting versions prior to 1.15.45. The root cause of the flaw is the failure to properly sanitize, validate, or parameterize user-controlled values before they are integrated into dynamically constructed SQL queries.\nIn a second-order SQL injection attack flow, the exploitation occurs across multiple request-response cycles. First, an authenticated user with subscriber-level privileges submits a specially crafted payload into an input vector associated with a database-backed choice field. The application stores this malicious input within the database without immediate execution or adequate neutralization.\nAt a later stage, when the application retrieves the stored data to construct and execute a dynamic SQL query—such as when rendering the choice field or processing form submissions—the unsanitized input is concatenated directly into the query string. This alters the intended logic of the SQL statement.\nBecause the vulnerability requires subscriber-level privileges, an attacker must first authenticate to the WordPress platform with low-level access. Network exposure corresponds to the standard web application attack surface over HTTP or HTTPS. The payload behavior involves database query manipulation, which can lead to post-exploitation impacts such as unauthorized data retrieval, enumeration of database schemas, or potential interaction with the underlying database management system depending on database user privileges and configuration."
}