CVE-2026-15993 is a blind SQL Injection vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The flaw exists in the handling of the '{username}' placeholder within the WHERE clause of a DB-backed dynamic choice field. Because user input is not properly escaped or prepared, authenticated attackers with subscriber-level privileges can inject additional SQL queries. Exploitation requires configuring a form with the vulnerable dynamic choice field and manipulating the display_name field to include SQL payloads before invoking the fm_reload_input AJAX endpoint. This vulnerability affects all versions up to and including 1.15.44.

An attacker with subscriber-level access or higher can exploit this vulnerability to perform blind SQL Injection, allowing them to append SQL queries to existing ones and extract sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and avoid using DB-backed dynamic choice fields with the '{username}' placeholder in the WHERE clause. Monitor vendor communications for official patches or updates.