The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin versions up to and including 1.15.44 contain a blind SQL Injection vulnerability. This occurs because the plugin insufficiently escapes user-supplied input in the {username} placeholder within the WHERE clause of a DB-backed dynamic choice field. An authenticated attacker with subscriber-level privileges can set their display_name to a crafted SQL payload via the WordPress profile edit screen and then trigger the fm_reload_input AJAX endpoint to inject additional SQL queries. This vulnerability enables extraction of sensitive information from the database without proper input sanitization or query preparation.

An authenticated attacker with subscriber-level access or higher can exploit this vulnerability to perform blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact), but confidentiality is impacted. The attack requires specific plugin configuration and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, consider restricting subscriber-level access or disabling the use of DB-backed dynamic choice fields referencing the {username} placeholder. Monitor vendor communications for updates and apply official patches once released.