CVE-2026-11776 describes a SQL Injection vulnerability (CWE-89) in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The issue arises from improper neutralization of special elements in the 'groupids' parameter, which is insufficiently escaped and lacks proper SQL query preparation. Authenticated attackers with administrator-level access can exploit this to append arbitrary SQL commands to existing queries, potentially extracting sensitive database information. The vulnerability affects all versions up to and including 1.15.43. There is no vendor advisory or patch currently available to address this issue.

An attacker with administrator-level privileges can exploit this vulnerability to execute unauthorized SQL queries, potentially leading to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is impacted. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual database activity related to the 'groupids' parameter. Avoid using the affected plugin versions if possible.