CVE-2026-3330 is an SQL Injection vulnerability in the Form Maker by 10Web WordPress plugin affecting all versions up to 1.15.40. The issue arises because the `WDW_FM_Library::validate_data()` method removes WordPress's default magic quotes protection by calling `stripslashes()` on user input, and the `FMModelSubmissions_fm::get_labels_parameters()` function concatenates user input directly into SQL queries without using the `$wpdb->prepare()` method. This allows authenticated administrators to inject additional SQL commands via parameters such as 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search'. Additionally, the Submissions controller does not verify nonces for the 'display' task, enabling exploitation through CSRF by tricking an administrator into clicking a crafted link.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The lack of nonce verification for a specific task also allows the vulnerability to be triggered via CSRF, increasing the attack surface. There is no indication of impact on data integrity or availability, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and avoid clicking suspicious links that could trigger CSRF attacks. Monitor vendor channels for updates and apply patches promptly once released.