The vulnerability is a blind SQL injection that occurs through the '{username}' placeholder used in the WHERE clause of Dynamic-Choice Fields in the Form Maker by 10Web WordPress plugin. It allows an authenticated user with subscriber-level or higher access to supply a malicious display_name via the WordPress profile edit screen, then trigger the fm_reload_input AJAX endpoint to inject additional SQL queries that can read sensitive database content. This attack does not rely on unauthenticated access, but the ability to modify the display_name and trigger the AJAX request gives the adversary enough control for data exfiltration.

All WordPress installations that use the Form Maker by 10Web plugin version 1.15.44 or earlier are affected. The issue exists in every release up to and including 1.15.44; newer releases are not impacted.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. However, because the attack requires only subscriber-level access, sites that allow many users to log in as subscribers are at risk of having their database contents disclosed. The attacker must be able to change the display_name field and trigger the fm_reload_input request; otherwise, the injection cannot proceed.