CVE-2026-11777 Overview
CVE-2026-11777 is a SQL Injection vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress. The flaw exists in all versions up to and including 1.15.43. The vulnerability stems from insufficient escaping of the user-supplied name parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with administrator-level access can append additional SQL queries to existing statements and extract sensitive data from the WordPress database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can inject arbitrary SQL through the name parameter to read sensitive information from the WordPress database.
Affected Products
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder for WordPress (all versions through 1.15.43)
- WordPress sites with the form-maker plugin installed and active
- Affected files include admin/controllers/Select_data_from_db.php and admin/models/FMSelectDataFromDb.php
Discovery Timeline
- 2026-06-18 - CVE-2026-11777 published to NVD
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-11777
Vulnerability Analysis
The Form Maker plugin exposes a data selection feature that builds SQL queries using the name request parameter. The plugin concatenates the parameter into the SQL statement without prepared statements or proper escaping. An attacker submitting a crafted name value can break out of the intended query context and append additional SQL clauses. Because the vulnerable code path requires administrator privileges, exploitation is constrained to actors who already control or have compromised a privileged WordPress account. Successful exploitation lets the attacker enumerate and exfiltrate data from any table accessible to the WordPress database user, including the wp_users table containing password hashes and email addresses.
Root Cause
The root cause is the use of unsanitized input concatenation in SQL statements built within admin/controllers/Select_data_from_db.php (line 84) and admin/models/FMSelectDataFromDb.php (lines 88 and 94). The plugin does not call $wpdb->prepare() with placeholders for the name parameter and does not apply WordPress sanitization helpers such as esc_sql() or strict allowlist validation before embedding the value into the query.
Attack Vector
Exploitation requires network access to the WordPress admin interface and valid administrator credentials. The attacker submits a request to the Form Maker administrative endpoint that processes the name parameter and appends SQL syntax such as UNION SELECT clauses or stacked subqueries. The injected SQL executes with the privileges of the WordPress database user. Code-level details are available in the WordPress Form Maker Select DB Code and the Wordfence Vulnerability Analysis.
No public proof-of-concept exploit is available at the time of publication. See the security advisory referenced above for technical details.
Detection Methods for CVE-2026-11777
Indicators of Compromise
- Web server access logs containing requests to Form Maker admin endpoints with SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the name parameter.
- Database query logs showing unexpected SELECT statements joined to wp_users, wp_usermeta, or wp_options originating from the plugin's controllers.
- Unusual outbound data transfers immediately following administrator authentication events.
Detection Strategies
- Inspect HTTP request bodies and query strings sent to wp-admin/admin.php actions handled by form-maker for SQL metacharacters in the name parameter.
- Enable MySQL or MariaDB general query logging during incident response and correlate suspicious queries with WordPress administrator session IDs.
- Apply web application firewall rules that flag SQL injection signatures against authenticated admin traffic.
Monitoring Recommendations
- Alert on creation of new WordPress administrator accounts or unexpected logins to existing administrator accounts.
- Monitor the integrity of the form-maker plugin directory and verify version against the patched release.
- Track database error rates from the WordPress site, as injection attempts frequently produce syntax errors before a working payload is achieved.
How to Mitigate CVE-2026-11777
Immediate Actions Required
- Update the Form Maker by 10Web plugin to the version released after 1.15.43 that contains the fix referenced in the WordPress Form Maker Code Changeset.
- Rotate WordPress administrator passwords and invalidate active sessions if the plugin was running an affected version.
- Audit the wp_users table for unauthorized accounts and review recent administrator activity logs.
Patch Information
The vendor addressed the issue in the version following 1.15.43. The fix introduces proper preparation and escaping for the name parameter in Select_data_from_db.php and FMSelectDataFromDb.php. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched release manually. Review the Wordfence Vulnerability Analysis for the confirmed fixed version.
Workarounds
- Deactivate the Form Maker plugin until the patched version is installed on production WordPress instances.
- Restrict access to WordPress administrator accounts using multi-factor authentication and IP allowlisting on wp-admin.
- Deploy a web application firewall rule that blocks SQL keywords in the name parameter of Form Maker admin requests.
# Configuration example: update the Form Maker plugin via WP-CLI
wp plugin update form-maker --version=latest
wp plugin list --name=form-maker --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
