The vulnerability lies in the Form Maker plugin for WordPress, where the MySQL Mapping feature fails to properly escape input before executing database queries. This flaw permits an attacker to inject arbitrary SQL statements, potentially modifying, deleting, or exfiltrating data stored by the site. Because the issue is tied to a plugin that runs in a web context, successful exploitation could compromise the confidentiality, integrity, or availability of database contents used by the affected WordPress installation.

The affected system is the Form Maker plugin distributed by 10Web for WordPress. The flaw exists in all releases prior to version 1.15.38. Hosts running older versions of this plugin—particularly sites that have enabled the MySQL Mapping feature—are at risk. No other products or platforms are mentioned, so the scope is limited to WordPress sites using this specific plugin.

The CVSS base score of 6.8 places the issue in the medium severity range, indicating that a successful exploit would have non‑negligible impact. The EPSS score is below 1 %, suggesting that exploitation is relatively uncommon, and the flaw is not yet listed in CISA’s KEV catalog. Inference: the attack vector is web‑based; an attacker needs the ability to submit crafted form data or otherwise trigger the MySQL Mapping logic, which is typically accessible to authenticated or unauthenticated users, depending on plugin settings. The lack of defensive payload preparation simplifies the exploit path.