The vulnerability allows authenticated WordPress administrators to execute arbitrary SQL statements through malformed input sent to the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' parameters. The plugin’s validation routine removes WordPress’s magic quote protection, and the query construction directly concatenates user data without any prepared statement handling. As a result, an attacker can append additional SQL commands to the query, potentially extracting sensitive database contents. In addition, the submissions controller skips nonce verification for the display task, enabling a CSRF attack that could trigger the injection if a privileged user visits a crafted link.

All instances of the 10Web Form Maker plugin for WordPress up to and including version 1.15.40 are affected. This includes any site that has installed the plugin and has users with administrator or higher privileges.

The flaw has a CVSS score of 4.9, indicating moderate severity. Because exploitation requires administrator access, the likelihood of successful exploitation is lower than for a public-facing vulnerability, but the presence of a CSRF vector raises the risk for compromised user sessions. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog.