CVE-2026-95808 10web CVE debrief

Who should care

Defenders responsible for WordPress installations with the Form Maker by 10Web plugin should assess exposure and apply patches or updates to vulnerable versions. This includes reviewing compensating controls for exposed systems, monitoring for suspicious activity, and verifying patch application. Security teams should prioritize this vulnerability due to its potential impact on database security and the ease of exploitation.

Why it matters

The Form Maker by 10Web plugin vulnerability allows unauthenticated SQL injection, potentially leading to sensitive information extraction and database disruption. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

• Potential extraction of sensitive information from the database
• Possible disruption of database operations
• Increased risk of data breaches
• Need for verification of patch application and vulnerability remediation

Technical summary

The Form Maker by 10Web plugin for WordPress, versions up to and including 1.15.48, is vulnerable to blind SQL Injection via the 'inputs' parameter. The vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into existing queries, potentially leading to sensitive information extraction from the database. The vulnerability can be exploited by obtaining the nonce required to reach the vulnerable handler, which is emitted to every public page that renders a form.

Defensive priority

High priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Form Maker by 10Web plugin versions up to 1.15.48
• Verify and apply patches or updates to vulnerable versions
• Monitor for suspicious SQL query activity
• Restrict access to sensitive database information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.