Introduction
An unauthenticated SQL injection in the Form Maker by 10Web WordPress plugin lets remote attackers extract sensitive information from the database without any credentials. The plugin has over 30,000 active installations, so CVE-2026-3359 is a meaningful risk for organizations that rely on it for contact forms and user input collection.
Form Maker by 10Web is a drag-and-drop contact form builder plugin for WordPress. It lets site administrators create mobile-friendly forms without writing code, and it is compatibility-tested up to WordPress 6.9.4. Because it is popular with small and mid-sized businesses, a flaw in this plugin matters to WordPress security well beyond any single site.
Technical Information
CVE-2026-3359 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The vulnerability is in the plugin's handling of the inputs parameter, and it has two causes. The plugin does not sufficiently escape user-supplied data passed through this parameter, and the SQL query that consumes this data is not properly built with prepared statements.
WordPress plugins are expected to parameterize queries with $wpdb->prepare(), so that user input cannot change the structure of the SQL statement. When that step is missing or incomplete and input escaping is also insufficient, classic SQL injection becomes possible.
The CVSS 3.x vector for this vulnerability is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which breaks down as follows:
| CVSS Component | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the network |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No victim action required |
| Scope | Unchanged | Impact limited to the vulnerable component |
| Confidentiality | High | Full read access to database contents |
| Integrity | None | No data modification |
| Availability | None | No denial of service |
Based on the available information, the attack works like this:
- An attacker identifies a WordPress site running Form Maker by 10Web version 1.15.42 or earlier.
- The attacker crafts a request with a malicious payload in the
inputsparameter. The parameter value is not properly escaped or parameterized before it goes into a SQL query, so the database executes the injected SQL. - The attacker appends additional SQL queries to the existing query logic (this is an append-style injection, not a replacement). That lets the attacker use techniques such as UNION-based extraction or conditional (blind) injection to read arbitrary data from the database.
- The attacker gets back sensitive information, which could include WordPress user credentials, email addresses, form submission data, or other stored content.
No authentication is required. Any internet-facing WordPress site running a vulnerable version of this plugin is open to automated scanning and exploitation, with nothing standing in the way.
Affected Systems and Versions
The vulnerability affects the following:
| Software | Affected Versions | Fixed Version |
|---|---|---|
| Form Maker by 10Web (WordPress plugin) | All versions up to and including 1.15.42 | 1.15.43 |
Any WordPress installation running Form Maker by 10Web at version 1.15.42 or earlier is vulnerable, regardless of the WordPress core version.
Vendor Security History
10Web has a documented record of fixing security issues in Form Maker. The changelog shows that earlier SQL injection vulnerabilities and minor security flaws were fixed in version 1.14.3, and the 1.15.43 release explicitly addresses CVE-2026-3359. The vendor's responsiveness to reported issues is a positive signal. Still, SQL injection keeps coming back, which points to a systemic problem with input validation and query parameterization in the plugin's codebase. Organizations evaluating this plugin should weigh that pattern when they assess long-term risk.
