CVE-2026-11776: Form Maker 10Web WordPress SQLi Flaw

CVE-2026-11776 Overview

CVE-2026-11776 is a SQL Injection vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress. The flaw affects all plugin versions up to and including 1.15.43. The vulnerability resides in the handling of the groupids parameter, which lacks proper escaping and prepared statement usage. Authenticated attackers with administrator-level access can append arbitrary SQL queries to existing database operations. Successful exploitation enables extraction of sensitive information from the WordPress database, including user credentials, session tokens, and configuration data. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can inject arbitrary SQL queries through the groupids parameter, exposing sensitive database contents on WordPress sites running Form Maker plugin versions up to 1.15.43.

Affected Products

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress
All versions up to and including 1.15.43
WordPress installations with the affected plugin activated

Discovery Timeline

2026-06-18 - CVE-2026-11776 published to the National Vulnerability Database
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-11776

Vulnerability Analysis

The vulnerability is a generic SQL Injection [CWE-89] that exists because the Form Maker plugin concatenates the user-supplied groupids parameter directly into a SQL query. The plugin neither escapes the input with esc_sql() nor uses WordPress's $wpdb->prepare() parameterized query interface.

Affected code paths include admin/controllers/Generete_csv.php and helper functions located in framework/WDW_FM_Library.php. An authenticated administrator submitting a crafted groupids value can break out of the intended query context and append arbitrary SQL clauses. The resulting query executes with the database privileges of the WordPress application user, granting read access to the entire WordPress schema.

Because exploitation requires administrator-level credentials, the practical risk centers on privilege containment, lateral movement after credential compromise, and multi-tenant or delegated-admin WordPress deployments where lower-trust administrators should not have database-wide read access.

Root Cause

The root cause is insufficient input validation combined with unsafe SQL query construction. The groupids parameter is treated as a trusted value and inserted into a SQL statement without sanitization or parameter binding. WordPress provides $wpdb->prepare() precisely to prevent this class of bug, but the affected functions bypass it.

Attack Vector

The attack vector is network-based and requires authentication. An attacker who has obtained or been granted administrator-level access to the WordPress dashboard submits a malicious value in the groupids HTTP request parameter to a Form Maker endpoint, such as the CSV export controller. The injected SQL is appended to the legitimate query and executed against the WordPress database.

The vulnerability mechanism is documented in the affected source files at WordPress CSV Generator Code and WordPress Library Code Snippet. No verified public proof-of-concept code is currently available.

Detection Methods for CVE-2026-11776

Indicators of Compromise

HTTP requests to Form Maker admin endpoints containing SQL meta-characters such as UNION, SELECT, --, /*, or single quotes inside the groupids parameter.
Unusual or oversized values in the groupids query string or POST body, including comma-separated payloads that contain SQL keywords.
Unexpected CSV export activity from administrator accounts, particularly outside business hours.
Database error messages or warnings referencing Generete_csv.php or WDW_FM_Library.php in PHP or web server logs.

Detection Strategies

Inspect WordPress and web server access logs for requests to admin/controllers/Generete_csv.php containing non-numeric values in groupids.
Deploy web application firewall (WAF) rules that flag SQL Injection signatures targeting WordPress plugin parameters.
Correlate administrator login events with subsequent SQL error spikes or anomalous database read volumes.
Use file integrity monitoring to detect unauthorized changes to plugin files or the WordPress wp-config.php after suspected exploitation.

Monitoring Recommendations

Forward WordPress audit logs, web server access logs, and MySQL/MariaDB query logs to a centralized SIEM for correlation.
Baseline normal administrator activity for Form Maker and alert on deviations such as bulk record exports.
Monitor for new or modified WordPress administrator accounts following any suspected SQL Injection attempt.
Track plugin version inventory across all WordPress instances to identify hosts still running Form Maker 1.15.43 or earlier.

How to Mitigate CVE-2026-11776

Immediate Actions Required

Update the Form Maker by 10Web plugin to the latest patched release available from the WordPress plugin repository.
Audit all WordPress administrator accounts and remove or downgrade any that do not require full administrative privileges.
Rotate WordPress administrator passwords and any database credentials that may have been exposed via the affected query path.
Review database read logs for suspicious queries originating from the WordPress application user since the plugin was installed.

Patch Information

A fix is referenced in the WordPress Changeset Overview and analyzed in the Wordfence Vulnerability Analysis. Administrators should install the version released after 1.15.43 that enforces input validation and prepared statements on the groupids parameter.

Workarounds

Deactivate the Form Maker plugin until the patched version can be installed if updating is not immediately feasible.
Restrict access to the WordPress admin interface using IP allow-listing at the web server or WAF layer.
Enforce multi-factor authentication on all administrator accounts to reduce the likelihood of credential abuse.
Apply virtual patching through a WAF rule that blocks non-numeric input in the groupids parameter for Form Maker endpoints.

bash

# Example WAF rule (ModSecurity) blocking non-numeric groupids values
SecRule ARGS:groupids "!@rx ^[0-9,]+$" \
    "id:1026011776,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-11776 - Form Maker groupids SQL Injection attempt blocked',\
    tag:'attack-sqli',\
    severity:'WARNING'"