The Form Maker WordPress plugin fails to properly prepare SQL queries when its "MySQL Mapping" feature is active, which could allow an attacker to inject arbitrary SQL. Based on the description, it is inferred that this flaw could expose the database to unauthorized reads, writes, or deletions, impacting the confidentiality and integrity of site data.

WordPress sites that have the Form Maker plugin by 10Web installed at a version prior to 1.15.38 and have enabled the MySQL Mapping feature are affected.

The available data does not provide a CVSS or EPSS score, so the severity cannot be quantified. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the vulnerability by supplying malicious input through the plugin’s form interface, enabling execution of unintended SQL statements if the MySQL Mapping feature is engaged.