CVE-2026-39502: Form Maker by 10Web SQLi Vulnerability

CVE-2026-39502 Overview

CVE-2026-39502 is an unauthenticated SQL injection vulnerability affecting the Form Maker by 10Web WordPress plugin in versions up to and including 1.15.38. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Remote attackers can send crafted requests without authentication to inject SQL statements into backend queries.

The issue impacts WordPress sites that use Form Maker to build and manage forms. Because exploitation requires no privileges and no user interaction, the vulnerability is reachable directly over the network from any unauthenticated client.

Critical Impact
Unauthenticated attackers can manipulate backend SQL queries against WordPress installations running Form Maker by 10Web ≤ 1.15.38, exposing database contents and altering site behavior.

Affected Products

Form Maker by 10Web WordPress plugin versions ≤ 1.15.38
WordPress sites with the vulnerable plugin installed and activated
Underlying MySQL/MariaDB databases backing affected WordPress installations

Discovery Timeline

2026-06-15 - CVE-2026-39502 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39502

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input that is concatenated into SQL queries by the Form Maker by 10Web plugin. An unauthenticated attacker can submit crafted parameters to a plugin endpoint, breaking out of the intended query context and executing attacker-controlled SQL.

The scope is marked as changed, which indicates the injected SQL can affect resources beyond the vulnerable component itself, including data stored across the WordPress database. Confidentiality impact is high, while integrity is not directly affected and availability impact is low.

Practical consequences include extraction of arbitrary database rows such as the wp_users table containing password hashes, session tokens, and form submissions. Attackers can also enumerate database schema, version, and privileges using time-based or UNION-based techniques.

Root Cause

The root cause is missing or insufficient parameterization of SQL statements built from request input. User-controlled values reach the database query layer without being bound through prepared statements or properly escaped using $wpdb->prepare(), the standard WordPress sanitization API.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues HTTP requests to a public plugin endpoint, supplying malicious values in parameters that the plugin interpolates into SQL. Refer to the Patchstack advisory for technical details on the affected request paths and parameters.

Detection Methods for CVE-2026-39502

Indicators of Compromise

HTTP requests to Form Maker plugin endpoints containing SQL meta-characters such as ', ", --, /*, UNION SELECT, or SLEEP(.
Anomalous outbound database query latency or repeated identical requests with incrementing payloads, indicative of time-based blind SQL injection.
Web server access logs showing unauthenticated POST or GET requests to admin-ajax.php actions registered by Form Maker with unusual parameter values.
Unexpected new administrator accounts or modified wp_options entries following suspicious plugin traffic.

Detection Strategies

Inspect WordPress and web server logs for query strings containing common SQLi patterns directed at Form Maker endpoints.
Enable MySQL general or slow query logging and review for malformed queries originating from PHP-FPM workers handling plugin requests.
Deploy a Web Application Firewall (WAF) ruleset that flags libinjection-classified SQL payloads against /wp-admin/admin-ajax.php and plugin-specific routes.

Monitoring Recommendations

Alert on bursts of 4xx/5xx responses from Form Maker URLs, which often accompany SQLi probing.
Monitor for unusual SELECT activity touching wp_users, wp_usermeta, or plugin tables outside normal administrative hours.
Correlate authentication events with preceding unauthenticated requests to the plugin to detect post-exploitation account creation or password resets.

How to Mitigate CVE-2026-39502

Immediate Actions Required

Update Form Maker by 10Web to a version newer than 1.15.38 as soon as a fixed release is published by the vendor.
If a patched version is not yet available, deactivate and remove the plugin until a fix is released.
Rotate WordPress administrator credentials and invalidate active sessions, assuming credentials and hashes in the database may have been exposed.
Review the wp_users table for unauthorized accounts and the wp_options table for tampered values.

Patch Information

At the time of publication, the Patchstack advisory lists Form Maker by 10Web versions up to 1.15.38 as vulnerable. Apply the vendor-supplied update referenced in the advisory and verify the installed version through the WordPress plugins page after upgrading.

Workarounds

Place the affected site behind a WAF with active SQL injection signatures and virtual patching for the plugin's endpoints.
Restrict access to Form Maker administrative endpoints via IP allowlisting at the reverse proxy or web server layer.
Apply database least-privilege by ensuring the WordPress MySQL user cannot perform schema modifications or access unrelated databases.

bash

# Example: restrict Form Maker plugin endpoints at the nginx layer
location ~* /wp-content/plugins/form-maker/ {
    allow 203.0.113.0/24;   # trusted administrative range
    deny all;
}