CVE-2026-95808: Form Maker WordPress Plugin SQLi Vulnerability

CVE-2026-95808 Overview

The Form Maker by 10Web plugin for WordPress contains a blind SQL injection vulnerability in the inputs parameter. The flaw affects all versions up to and including 1.15.48. Unauthenticated attackers can append arbitrary SQL to existing queries and extract sensitive data from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, so an attacker can retrieve it directly from page source without authentication. This classifies the issue as SQL Injection [CWE-89] with a network attack vector.

Critical Impact
Unauthenticated attackers can exfiltrate database contents, including user records and WordPress secrets, through blind SQL injection against the Form Maker plugin.

Affected Products

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder for WordPress
All plugin versions up to and including 1.15.48
WordPress sites publicly rendering any Form Maker form

Discovery Timeline

2026-10-14 - CVE-2026-95808 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-95808

Vulnerability Analysis

The Form Maker plugin exposes a frontend handler that processes form submissions containing an inputs parameter. The plugin concatenates values from this parameter into SQL statements without sufficient escaping or prepared statement binding. An attacker who submits a crafted payload can inject additional SQL clauses that execute against the WordPress database.

The handler enforces a WordPress nonce check as its primary access control, but the plugin emits the required nonce in the HTML of every public page that renders a form. An unauthenticated attacker only needs to request a page containing a form, parse the nonce from the response, and replay it alongside the malicious inputs payload. The injection is blind, meaning the application does not return database output in responses, so attackers typically use boolean-based or time-based techniques to extract data byte by byte.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL commands [CWE-89]. The vulnerable code paths referenced in the Wordfence advisory reside in form-maker.php and framework/WDW_FM_Library.php, where values derived from the submitted inputs parameter are placed into query strings without using wpdb::prepare or sufficient sanitization. Reliance on a publicly exposed nonce as the gating control compounds the issue by providing no real barrier against unauthenticated attackers.

Attack Vector

Exploitation is network based and requires no authentication or user interaction. An attacker fetches any public page rendering a Form Maker form, extracts the embedded nonce, and sends a POST request to the plugin's submission endpoint with a malicious inputs payload. Because the injection is blind, attackers typically use conditional response differences or SLEEP()-based timing primitives to enumerate schema, dump the wp_users table, and recover password hashes or authentication secrets. Technical references for the affected code are available in the Wordfence Vulnerability Analysis and the WordPress Form Maker Changeset Update.

Detection Methods for CVE-2026-95808

Indicators of Compromise

POST requests to the Form Maker submission endpoint containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or IF( in the inputs parameter.
Repeated submissions from the same source IP within short windows, consistent with blind SQL injection enumeration.
Abnormally long response times on form submission handlers, indicating time-based injection probing.
Database query logs showing malformed or appended WHERE clauses originating from the Form Maker plugin.

Detection Strategies

Review WordPress and web server access logs for admin-ajax.php or Form Maker controller requests carrying encoded SQL metacharacters in inputs.
Enable MySQL general query or slow query logging and alert on statements that reference Form Maker tables combined with injected conditional expressions.
Deploy a Web Application Firewall rule set that inspects the inputs parameter for SQL syntax patterns before it reaches PHP.

Monitoring Recommendations

Monitor outbound traffic from the web server for unusual exfiltration patterns following suspicious form submissions.
Track newly created or modified WordPress administrator accounts, which may indicate successful credential extraction and reuse.
Baseline normal form submission volume per source and alert on sudden spikes consistent with automated injection tooling such as sqlmap.

How to Mitigate CVE-2026-95808

Immediate Actions Required

Update the Form Maker by 10Web plugin to the version published after 1.15.48 that includes the fix referenced in the plugin changeset.
Audit WordPress user accounts and rotate all administrator passwords and application secrets if exploitation is suspected.
Rotate WordPress salts and keys in wp-config.php if database extraction cannot be ruled out.
Block or rate-limit traffic to the Form Maker submission endpoint at the WAF or reverse proxy while patching is in progress.

Patch Information

The vendor addressed the issue in the plugin update tracked by the WordPress Form Maker Changeset Update. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin directory with the fixed release. Confirm the installed version is greater than 1.15.48 after upgrade.

Workarounds

Temporarily deactivate the Form Maker plugin on sites that cannot be patched immediately.
Restrict access to pages that render Form Maker forms using authentication or IP allowlisting until the patch is applied.
Deploy virtual patching rules in a WAF that drop requests containing SQL metacharacters in the inputs parameter targeting the Form Maker controller.

bash

# Example ModSecurity rule to block SQLi patterns in the Form Maker inputs parameter
SecRule ARGS_NAMES "@rx ^inputs(\[|$)" \
    "id:1009580,\
    phase:2,\
    t:none,t:urlDecodeUni,t:lowercase,\
    chain,\
    deny,status:403,log,\
    msg:'CVE-2026-95808 Form Maker SQLi attempt'"
    SecRule ARGS "@rx (union\s+select|sleep\s*\(|benchmark\s*\(|/\*|--\s|information_schema)" \
        "t:none,t:urlDecodeUni,t:lowercase"