Description

Subscriber SQL Injection in Form Maker by 10Web <= 1.15.44 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T14:17:00.100Z",
  "pubdate": "2026-08-13T14:17:00.100Z",
  "executiveSummary": "This security assessment evaluates a Subscriber SQL Injection vulnerability affecting the Form Maker by 10Web plugin for WordPress, specifically impacting versions 1.15.44 and prior. The vulnerability arises from improper neutralization of special elements used in an SQL command within the application, allowing authenticated users with subscriber-level privileges to manipulate database queries. Successful exploitation of this flaw can lead to unauthorized access to sensitive database contents, including user credentials, configuration data, and potentially full database compromise depending on the database privileges associated with the web application. The risk implication is significant as it permits low-privileged users to bypass application logic and execute arbitrary SQL commands directly against the underlying database management system. Attacker capabilities include data exfiltration, database enumeration, and potential privilege escalation within the WordPress environment. Exploitation requires authenticated access at the subscriber privilege level, meaning an attacker must possess a valid low-privileged account on the target WordPress instance to interact with the vulnerable endpoints and trigger the insecure query execution.",
  "technicalDetails": "The vulnerability is classified as an SQL Injection (SQLi) flaw residing within the Form Maker by 10Web plugin, affecting versions 1.15.44 and below. The root cause of the vulnerability stems from the application accepting user-supplied input parameters without adequate sanitization, validation, or parameterized query implementation before incorporating them into database operations executed via the WordPress database abstraction layer ($wpdb). Specifically, input vectors processed by the plugin fail to properly escape meta-characters utilized in SQL syntax, allowing an authenticated attacker to inject malicious database statements into existing queries.\nThe attack flow begins when an authenticated user with subscriber privileges sends a crafted HTTP request containing malicious SQL payloads to the vulnerable parameter handled by the Form Maker by 10Web plugin. Because the application insufficiently validates or binds the input parameters securely, the input is concatenated directly into the SQL statement string executed by the database server. This allows the attacker to alter the intended logic of the SQL query structure, facilitating techniques such as UNION-based SQL injection, error-based extraction, or boolean-based blind injection.\nAuthentication and privilege requirements dictate that the attacker must authenticate to the WordPress site with at least a subscriber-level role. While this requires a valid account, the low barrier of entry for subscriber registration on many WordPress sites increases the overall attack surface. Network exposure is standard web-based, accessible via HTTP/HTTPS protocols where the WordPress instance is deployed. Post-exploitation impact encompasses unauthorized data retrieval, including the extraction of the wp_users table containing password hashes, session tokens, and other sensitive application data. Depending on database configurations and MySQL/MariaDB server privileges, advanced SQL injection techniques could theoretically allow for file reading or writing on the host server if specific database-level capabilities are enabled."
}