This vulnerability (CVE-2026-28184) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Form Maker plugin by 10Web. It affects versions up to 1.15.44 and allows an attacker with low privileges to inject SQL commands through subscriber input fields. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

An attacker with low privileges can exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted. The vulnerability affects the confidentiality and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying workarounds such as restricting access to the vulnerable functionality or input validation at the application level if feasible.