The vulnerability resides in the Form Maker by 10Web plugin for WordPress and allows a generic SQL injection through the 'groupids' request parameter. Insufficient escaping and missing SQL preparation enable authenticated users with administrator-level privileges to append malicious SQL statements to the existing query. This can lead to extraction of sensitive database content, compromising confidentiality of stored data.

All installations of the Form Maker by 10Web plugin for WordPress up to and including version 1.15.43 are affected. The flaw exists in every release version through 1.15.43 and is not present beyond that point. Sites using any of these versions are at risk if they grant administrator or higher access to users.

The CVSS v3 score of 4.9 classifies the flaw as moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack vector is inferred to be an authenticated session with administrator or higher privileges; an attacker must have such access to exploit the vulnerability. Once exploited, the attacker can read arbitrary data from the database by injecting additional SQL queries.