CVE-2026-39502: WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the Form Maker by 10Web WordPress plugin, affecting all versions up to and including 1.15.38. An attacker can reach the vulnerable endpoint over the network with no login or credentials required. Successful exploitation gives an attacker read access to the underlying database and limited ability to disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can send a crafted request from the public internet or any network path that reaches the WordPress installation.

• AuthenticationNot required

  No account, session, or credentials of any kind are needed to trigger the injection; the vulnerable code path is reachable anonymously.

• Victim interactionNot required

  The attacker sends a direct request to the server and no user action or social engineering is required to complete the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable without needing to satisfy any race condition, specific memory layout, or environmental prerequisite.

Blast Radius

• An attacker can read arbitrary rows from the WordPress database, including user credentials, session tokens, and any data submitted through forms.
• Because the injection operates in a Changed scope (S:C), impact can extend beyond the WordPress application itself to other data stores or services sharing the same database server.
• Service availability is partially affected; the attacker can issue resource-intensive queries that degrade or interrupt database responsiveness.