CVE-2026-3330 Details
Description
The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters in all versions up to, and including, 1.15.40. This is due to the `WDW_FM_Library::validate_data()` method calling `stripslashes()` on user input (removing WordPress's `wp_magic_quotes()` protection) and the `FMModelSubmissions_fm::get_labels_parameters()` function directly concatenating user-supplied values into SQL queries without using `$wpdb->prepare()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the `display` task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.
A SQL injection vulnerability has been identified in the Form Maker by 10Web plugin for WordPress, affecting all versions up to and including 1.15.40. The vulnerability arises from the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters. The issue is caused by the 'WDW_FM_Library::validate_data()' method, which removes WordPress's 'wp_magic_quotes()' protection from user input. Subsequently, the 'FMModelSubmissions_fm::get_labels_parameters()' function concatenates these unprotected values directly into SQL queries without proper sanitization, allowing authenticated attackers with Administrator-level access to manipulate SQL queries and potentially extract sensitive database information. Additionally, the Submissions controller's 'display' task lacks nonce verification, enabling cross-site request forgery (CSRF) exploitation by tricking an administrator into clicking a malicious link.
Users are advised to update the Form Maker by 10Web plugin to version 1.15.41 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 17, 2026CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 10Web Form Maker | <= 1.15.40 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | New CVE Received | [email protected] |