CVE-2026-16977 in Form Maker Plugin
Summary
by MITRE • 08/12/2026
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The Form Maker by 10Web WordPress plugin vulnerability represents a critical security flaw that enables low-privileged users to execute malicious SQL commands through a second-order SQL injection attack. This vulnerability affects versions prior to 1.15.45 and specifically targets the plugin's handling of database-backed choice fields where user input is not properly sanitized before being incorporated into dynamic SQL queries. The issue manifests when subscriber-level users create or modify form choices that are subsequently processed through a SQL query construction mechanism.
The technical implementation of this vulnerability stems from improper parameterization of user-controlled data within SQL query construction logic. When administrators configure database-backed choice fields, the plugin accepts user inputs such as choice labels and values without adequate sanitization or parameter binding. This creates an environment where maliciously crafted input can alter the intended SQL query structure, allowing attackers to inject arbitrary SQL commands that execute with the privileges of the affected database user.
Second-order SQL injection occurs because the malicious input is initially stored in the database without immediate execution, then later retrieved and processed within a new SQL context where it becomes active. This delayed execution makes detection more challenging for security monitoring systems and allows attackers to bypass traditional input validation mechanisms that might only inspect initial request data rather than post-processing behaviors.
The operational impact of this vulnerability extends beyond simple data theft or manipulation to potentially enable complete database compromise. An attacker with subscriber-level access could extract sensitive information from the WordPress database, including user credentials, configuration settings, and other stored data. The attack surface includes potential privilege escalation opportunities if the database user has elevated permissions beyond basic read operations.
This vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws in software applications. From an adversarial perspective, this weakness corresponds to ATT&CK technique T1078.004 for valid accounts and T1566.001 for credential access through exploitation of web application vulnerabilities. The attack vector represents a significant concern for WordPress environments where multiple user roles exist, as it allows privilege escalation from subscriber level to potentially higher administrative privileges depending on database permissions.
Mitigation strategies should prioritize immediate patching to version 1.15.45 or later, which implements proper parameterization of all user-controlled inputs within SQL query construction. Organizations should also implement additional security measures including input validation at multiple layers, database user privilege minimization, and comprehensive monitoring for suspicious database activities. Regular security audits of WordPress plugins and themes remain essential for identifying similar vulnerabilities in the broader ecosystem.
The vulnerability demonstrates the critical importance of proper input sanitization and parameter binding in database interactions, particularly when dealing with dynamic query construction based on user-provided data. This flaw underscores the need for comprehensive security testing including both static analysis and dynamic penetration testing of web applications to identify second-order injection vulnerabilities that might otherwise remain undetected until exploitation occurs in production environments.