CVE-2026-3330 is an SQL Injection vulnerability in the Form Maker by 10Web plugin for WordPress, affecting all versions up to 1.15.40. The issue arises because the `WDW_FM_Library::validate_data()` method removes WordPress's magic quotes protection by calling `stripslashes()` on user input, and the `FMModelSubmissions_fm::get_labels_parameters()` function concatenates user input directly into SQL queries without using the `$wpdb->prepare()` method. This allows authenticated users with Administrator privileges to inject additional SQL commands via parameters such as 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search'. Additionally, the Submissions controller's 'display' task skips nonce verification, enabling Cross-Site Request Forgery (CSRF) attacks that can trick administrators into executing the injection via crafted links.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The lack of nonce verification for the 'display' task allows CSRF exploitation, increasing the attack surface by enabling attackers to trick administrators into triggering the vulnerability. The CVSS score of 4.9 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and avoid clicking on untrusted links that could trigger CSRF attacks. Monitor vendor channels for updates and apply patches promptly once released.