CVE-2024-2112 in Form Maker
Summary
by MITRE • 04/10/2024
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2112 affects the Form Maker by 10Web plugin for WordPress, specifically targeting versions up to and including 1.15.22. This represents a critical security flaw that undermines the integrity of user data within WordPress environments. The vulnerability manifests through the plugin's signature functionality, which was designed to allow users to create and store digital signatures within contact forms. However, improper implementation has created an exploitable condition that exposes sensitive user information to unauthorized parties. The flaw exists in the plugin's handling of signature data storage and retrieval mechanisms, creating a pathway for attackers to access information that should remain protected within the system's security boundaries.
The technical nature of this vulnerability falls under the category of sensitive data exposure, which aligns with CWE-200 - "Information Exposure" and represents a direct violation of data confidentiality principles. Attackers can exploit this weakness without requiring authentication credentials, making the attack surface particularly dangerous as it can be executed from any network location. The signature functionality within the plugin appears to store user-generated signature data in a manner that does not adequately protect against unauthorized access, potentially exposing not only signature files but potentially associated metadata or user information. This vulnerability operates at the application layer and can be classified under the MITRE ATT&CK framework as a form of credential access or data exposure technique, specifically mapping to T1552.001 - "Credentials in Files" or T1567.002 - "Exfiltration Over Web Service" depending on the attack vector used for exploitation.
The operational impact of this vulnerability extends beyond simple data exposure, as signature data often contains personal identifiers or authentication elements that could be leveraged in subsequent attacks. Organizations running affected WordPress installations face potential risks including identity theft, unauthorized access to systems, and compromise of user trust. The vulnerability affects all versions up to 1.15.22, indicating a widespread issue that could impact numerous WordPress deployments across different industries and use cases. The exposure of signature data could lead to cascading security issues, particularly in environments where signature verification is used for access control or authentication purposes, potentially enabling attackers to impersonate legitimate users or bypass security controls.
Mitigation strategies for this vulnerability should begin with immediate plugin updates to versions that address the exposed signature handling mechanisms. System administrators should conduct comprehensive vulnerability assessments to identify all instances of the affected plugin within their environments and ensure proper patch management protocols are implemented. Additional defensive measures include implementing network segmentation to limit access to WordPress installations, deploying web application firewalls to monitor for suspicious signature-related requests, and establishing monitoring procedures to detect unauthorized access attempts. Organizations should also consider implementing access controls that limit who can view or modify signature data within the WordPress system, and conduct regular security audits to identify similar vulnerabilities in other plugins or components. The remediation process must include thorough testing of updated versions to ensure that the patch does not introduce compatibility issues with existing form configurations or user workflows, while also validating that the signature functionality operates correctly without exposing sensitive information.