Form Maker by 10Web (WordPress plugin) is vulnerable to SQL Injection (SQLi) in versions up to and including 1.15.40. The flaw is reachable through the plugin’s handling of the parameters ip_search, startdate, enddate, username_search, and useremail_search. Because the issue requires Administrator-level access (or higher) and can also be triggered via CSRF for the relevant action, an attacker may be able to manipulate database queries to extract sensitive information.
Technically, the vulnerability stems from two related problems in the plugin’s code path. First, WDW_FM_Library::validate_data() calls stripslashes() on user input, which effectively removes WordPress’s wp_magic_quotes() protection rather than preserving safe escaping/normalization. Second, FMModelSubmissions_fm::get_labels_parameters() directly concatenates user-supplied values into SQL queries instead of using parameterized queries via $wpdb->prepare(). This combination allows an authenticated attacker to append additional SQL logic into an already-constructed query, enabling database information disclosure.
The NVD description also notes an additional exploitation enabler: the Submissions controller skips nonce verification for the display task. As a result, the SQLi-triggering request can be initiated via CSRF by tricking an administrator into clicking a crafted link, even if the attacker cannot directly execute the request from the victim’s browser without the victim’s interaction.
Impact is primarily data exposure (confidentiality impact) rather than direct remote code execution. The SQL injection can be used to extract sensitive information from the database by altering the query logic. The reported CVSS is 4.9 (medium) with a high required privilege level (PR:H) and network reachability (AV:N), but no user interaction is required by the CVSS vector (UI:N) even though the CSRF note implies an administrator click can be part of the real-world exploitation chain. The blast radius is limited to the WordPress site where the vulnerable plugin is installed and where an attacker can reach the vulnerable endpoints/tasks (directly with Administrator access, or indirectly via CSRF against an administrator).
Mitigation: upgrade the Form Maker by 10Web plugin to a version newer than 1.15.40, where the SQLi is fixed (i.e., where user input is no longer concatenated into SQL and where nonce verification is enforced for the display task). As a defense-in-depth measure, ensure the plugin (and WordPress) are kept up to date, and restrict administrator access where possible. For detection guidance, monitor for requests to the vulnerable submissions-related endpoints/tasks that include the parameters ip_search, startdate, enddate, username_search, and useremail_search, especially when requests originate from unexpected sources or when the display task is invoked without a valid nonce (if such validation is expected in the fixed version).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE-89