CVE-2025-15441: Form Maker by 10Web SQLi Vulnerability

CVE-2025-15441 Overview

CVE-2025-15441 is a SQL Injection vulnerability affecting the Form Maker by 10Web WordPress plugin in versions prior to 1.15.38. The vulnerability exists due to improper preparation of SQL queries when the "MySQL Mapping" feature is enabled, allowing attackers to potentially manipulate database queries and extract sensitive information under certain conditions.

Critical Impact

Attackers exploiting this vulnerability could potentially access, modify, or extract sensitive data from the WordPress database when the MySQL Mapping feature is actively used, compromising site confidentiality.

Affected Products

• Form Maker by 10Web WordPress plugin versions prior to 1.15.38
• WordPress installations utilizing the MySQL Mapping feature of Form Maker

Discovery Timeline

• 2026-04-13 - CVE-2025-15441 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-15441

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from inadequate input sanitization within the Form Maker plugin's MySQL Mapping functionality. When WordPress administrators configure forms to map submissions directly to MySQL database tables, the plugin fails to properly prepare SQL queries using parameterized statements or adequate escaping mechanisms.

The attack requires specific conditions to be met: the MySQL Mapping feature must be enabled and configured on a form, and an attacker must be able to submit crafted input through that form. While the network-based attack vector requires no authentication, the high attack complexity reflects these prerequisite conditions that must align for successful exploitation.

Successful exploitation could allow an attacker to read sensitive data from the database, including user credentials, configuration data, and other confidential information stored within WordPress tables.

Root Cause

The root cause of this vulnerability lies in the plugin's failure to use WordPress's native database abstraction layer ($wpdb->prepare()) or equivalent parameterized query mechanisms when constructing SQL statements for the MySQL Mapping feature. User-supplied form data is concatenated directly into SQL queries without proper sanitization, creating an injection point.

Attack Vector

The attack vector is network-based, requiring an attacker to submit maliciously crafted input through a vulnerable form configured with MySQL Mapping. The attacker does not need authentication to submit form data, but must identify a form with the vulnerable feature enabled.

The exploitation mechanism involves injecting SQL syntax into form fields that are mapped to database columns. When the plugin processes the submission and constructs the mapping query, the injected SQL code becomes part of the executed statement, potentially allowing the attacker to modify query logic and extract data from arbitrary database tables.

For detailed technical information about this vulnerability, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2025-15441

Indicators of Compromise

• Unusual or malformed form submissions containing SQL syntax characters such as single quotes, UNION statements, or comment sequences
• Unexpected database query patterns in WordPress debug logs related to Form Maker plugin
• Access log entries showing form submissions with encoded SQL payloads in POST data

Detection Strategies

• Review web application firewall (WAF) logs for SQL injection signatures targeting form submission endpoints
• Monitor database query logs for anomalous queries originating from Form Maker plugin functions
• Implement input validation monitoring to flag form submissions containing SQL metacharacters

Monitoring Recommendations

• Enable WordPress debug logging and monitor for database errors related to Form Maker operations
• Configure WAF rules to detect and block common SQL injection patterns in form submissions
• Implement real-time alerting for database access patterns that deviate from normal Form Maker behavior

How to Mitigate CVE-2025-15441

Immediate Actions Required

• Update Form Maker by 10Web plugin to version 1.15.38 or later immediately
• Temporarily disable the MySQL Mapping feature on all forms until the update is applied
• Review database access logs for any signs of prior exploitation attempts
• Consider implementing a Web Application Firewall (WAF) with SQL injection protection

Patch Information

The vulnerability has been addressed in Form Maker by 10Web version 1.15.38. WordPress administrators should update to this version or later through the WordPress plugin management interface or by downloading the latest version from the official WordPress plugin repository.

For additional details, consult the WPScan Vulnerability Report.

Workarounds

• Disable the MySQL Mapping feature in Form Maker plugin settings until the patch can be applied
• Implement server-level input filtering to sanitize form submissions before they reach the plugin
• Use a Web Application Firewall (WAF) to filter and block SQL injection attempts targeting form endpoints
• Restrict form access to authenticated users only where possible to reduce the attack surface