CVE-2026-11777: Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Form Maker by 10Webfrom your environment.Uninstall the Form Maker by 10Web WordPress plugin if it is not required or until a vendor fix is available.
- Configuration
Deactivate the plugin from the WordPress Plugins admin page or disable it by renaming/removing its plugin directory to prevent use of the vulnerable code.
WordPress plugin: Form Maker by 10Web activated = false - Compensating control
Restrict access to the WordPress administration interface (wp-admin) and plugin management to trusted IP addresses via firewall, VPN, or network ACLs to prevent authenticated administrator access from untrusted locations.
- Compensating control
Deploy Web Application Firewall (WAF) or IDS/IPS rules to detect and block SQL injection attempts against the plugin endpoints, including requests that manipulate the 'name' parameter.
- Operational
Audit logs and database query history for suspicious or unusual queries that reference the plugin or the 'name' parameter; if compromise or data exfiltration is suspected, rotate database credentials and other potentially exposed credentials and restore integrity from known-good backups as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11777?
CVE-2026-11777 has a medium severity score of 4.9.
How do I fix CVE-2026-11777?
To fix CVE-2026-11777, upgrade the Form Maker by 10Web plugin to version 1.15.44 or later.
What type of vulnerability is CVE-2026-11777?
CVE-2026-11777 is an authenticated SQL injection vulnerability.
Who is affected by CVE-2026-11777?
Any user with administrator privileges utilizing the Form Maker by 10Web plugin up to version 1.15.43 is affected by CVE-2026-11777.
Can CVE-2026-11777 lead to data exposure?
Yes, CVE-2026-11777 can potentially lead to data exposure due to the SQL injection vulnerability.