CVE-2026-15993

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45

Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The attack requires a form to be configured with a database-backed dynamic choice field using a WHERE template that references the {username} placeholder. An attacker can set their display name to a SQL payload via the WordPress profile edit screen and then trigger the fm reload input AJAX endpoint to append malicious queries and extract sensitive information from the database.

Recommendations Update to a version newer than 1.15.44. As a temporary mitigation, avoid using the {username} placeholder in the WHERE clause of dynamic-choice fields.