CVE-2026-95808: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

CVE-2026-95808 describes a blind SQL Injection vulnerability in the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin. The flaw exists in all versions up to and including 1.15.48, where the 'inputs' parameter is not properly escaped and the SQL query is not sufficiently prepared. An unauthenticated attacker can exploit this by appending additional SQL commands to extract sensitive database information. The nonce required to access the vulnerable handler is exposed on every public page that renders a form, facilitating easy exploitation.

An unauthenticated attacker can exploit this vulnerability to perform blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow integrity or availability impacts but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting the network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable endpoints if possible and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the nonce publicly or implement additional validation and sanitization on the 'inputs' parameter.