CVE-2026-11777

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.44

Description The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress contains a generic SQL Injection. This occurs because the name parameter is not sufficiently escaped and the existing SQL query lacks proper preparation. Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version later than 1.15.43.