CVE-2026-16977: Form Maker by 10Web SQLi Vulnerability

CVE-2026-16977 Overview

CVE-2026-16977 is a second-order SQL injection vulnerability in the Form Maker by 10Web WordPress plugin before version 1.15.45. The plugin fails to properly parameterize a user-controlled value substituted into a dynamic SQL query built for a database-backed choice field. Authenticated users at the subscriber level can inject malicious SQL that executes when the stored value is later processed by the plugin. The flaw is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Subscriber-level users can execute arbitrary SQL queries against the WordPress database, potentially extracting sensitive data including user credentials, session tokens, and administrative content.

Affected Products

Form Maker by 10Web WordPress plugin versions prior to 1.15.45
WordPress installations with the plugin activated and open subscriber registration
Sites relying on the plugin's database-backed choice field functionality

Discovery Timeline

2026-08-12 - CVE-2026-16977 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16977

Vulnerability Analysis

The vulnerability is a second-order SQL injection. In this pattern, malicious input is stored during one request and later retrieved and concatenated into a SQL query without proper parameterization. The Form Maker plugin accepts a user-controlled value that populates a database-backed choice field. When the plugin subsequently constructs a dynamic SQL statement referencing that stored value, the injected payload executes against the WordPress database.

Because exploitation requires only subscriber-level authentication, any site allowing open user registration is exposed. An attacker with a low-privilege account can read arbitrary data from the wp_users table, extract password hashes, or enumerate sensitive plugin-stored data. The attack does not require user interaction and traverses the network attack surface via standard authenticated HTTP requests.

Root Cause

The root cause is missing use of parameterized queries or $wpdb->prepare() when substituting the stored choice-field value into a dynamic SQL statement. String concatenation of untrusted input into SQL is the classic [CWE-89] failure pattern. Because the tainted value is stored first and consumed later, standard request-time input filtering does not catch the payload.

Attack Vector

An attacker registers or logs in as a subscriber, then submits a crafted value that populates the vulnerable choice field. When the plugin later builds the dynamic query referencing that stored value, the injected SQL fragment executes with the database privileges of the WordPress user, typically full read/write access to all site tables. See the WPScan Vulnerability Report for additional technical detail.

// No verified proof-of-concept code is publicly available.
// The vulnerability pattern involves storing a payload such as
// a crafted choice option value, which is later interpolated
// unsafely into a SELECT/UPDATE statement built by the plugin.

Detection Methods for CVE-2026-16977

Indicators of Compromise

Unexpected subscriber-level account registrations followed by Form Maker plugin interactions
Anomalous entries in Form Maker choice-field tables containing SQL syntax such as UNION SELECT, SLEEP(, or comment markers --
Unusual database error entries in PHP or MySQL logs referencing Form Maker plugin functions
Outbound queries or content exfiltration originating from the WordPress web process shortly after form submissions

Detection Strategies

Inspect Form Maker database tables for stored values containing SQL metacharacters, quotes, or SQL keywords in fields expected to hold simple choice labels
Enable and review WordPress query logging or use a database activity monitor to flag queries built dynamically by the plugin
Correlate low-privilege account activity with form-configuration or form-submission endpoints in web server access logs

Monitoring Recommendations

Monitor wp-admin/admin-ajax.php and Form Maker REST endpoints for POST requests from subscriber accounts
Alert on MySQL errors originating from the WordPress database user, which often accompany SQL injection probing
Track new user registrations and rapid privilege boundary testing patterns via SIEM correlation rules

How to Mitigate CVE-2026-16977

Immediate Actions Required

Update the Form Maker by 10Web plugin to version 1.15.45 or later immediately
Audit all subscriber-level accounts and disable those that appear suspicious or inactive
Review Form Maker configuration tables for previously injected payloads before patching

Patch Information

The vendor released a fix in Form Maker by 10Web version 1.15.45. The patch introduces proper parameterization for the affected choice-field query. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration in WordPress settings if the plugin cannot be updated immediately
Deactivate the Form Maker plugin until the patched version is deployed
Deploy a web application firewall rule blocking SQL metacharacters in Form Maker form-submission parameters
Restrict database user privileges for the WordPress account to limit blast radius of injection

bash

# Update Form Maker via WP-CLI
wp plugin update form-maker --version=1.15.45

# Verify installed version
wp plugin get form-maker --field=version

# Disable open registration as a temporary control
wp option update users_can_register 0