Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Form Maker by 10Web <= 1.15.44 - Attacker Can Steal Sensitive Data

CVE-2026-15993 · published 2 months ago
Summary

The Form Maker plugin for WordPress allows attackers with subscriber-level access to steal sensitive information from the database. This happens when a form is set up with a special field that references the user's name. To exploit this, an attacker must first change their display name to include malicious code and then trigger a specific action. To fix this, update the Form Maker plugin to version 1.15.45 or higher.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
10web form maker by 10web – mobile-friendly drag & drop contact form builder <= 1.15.44
Original advisory text
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Claus...
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published15 Aug 2026
Updated4 Nov 2026
First seen15 Aug 2026
Sources
CVE-2026-15993 · NVD
CVE-2026-15993 · MITRE
Track software like this
Free during beta