The vulnerability allows authenticated users to inject arbitrary SQL code via specific POST actions in the Form Maker plugin. By manipulating the name and search_labels parameters sent to admin-ajax.php, an attacker can read, alter, or elevate permissions on the WordPress database, giving direct access to sensitive data and the ability to modify site content or structure.

The flaw affects the 10Web Form Maker plugin for WordPress, specifically version 1.12.24 and all earlier releases. WordPress installations that have this plugin active, especially those with administrative accounts, are vulnerable.

The CVSS score of 7.1 classifies this as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires authentication, the attack vector is local but still dangerous for sites with weak access controls; the potential for data exfiltration or privilege escalation remains high until the plugin is patched or removed.