A high-severity SQL injection vulnerability in Form Maker by 10Web enables authenticated users to compromise database confidentiality and integrity.

This is a second-order SQL injection flaw caused by insufficient parameterization of user-supplied data in dynamic SQL queries. The vulnerability is exploitable by authenticated users with subscriber-level access.

With a CVSS score of 8.1, this vulnerability poses a significant risk to data security. Exploitation allows attackers to manipulate database queries, potentially leading to unauthorized data exfiltration, modification of application records, or total database compromise, which can cause severe operational disruption.

Immediate Action: Update the Form Maker by 10Web plugin to version 1.15.45.

Proactive Monitoring: Monitor database query logs for anomalous syntax or unexpected patterns originating from low-privileged user accounts.

Compensating Controls: Implement a Web Application Firewall with SQL injection protection rules to detect and block malicious payloads directed at form fields.

Public Exploit Available: Yes (publicly available via research documentation)

The presence of a public proof-of-concept elevates the urgency of this update. All WordPress installations utilizing this plugin should be patched to version 1.15.45 to mitigate the risk of database exploitation by authenticated users.