This vulnerability (CVE-2026-39502) is an SQL Injection issue classified under CWE-89 in the Form Maker by 10Web plugin, affecting versions up to and including 1.15.38. The flaw allows unauthenticated attackers to inject SQL commands, which can compromise the confidentiality of the database and cause partial denial of service. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No vendor advisory or patch information is available at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, leading to disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling the vulnerable plugin or restricting access to it if possible.