The Form Maker by 10Web plugin allows an attacker to inject SQL through the 'inputs' parameter because it is not properly escaped and is included directly in an SQL query. This injection can append arbitrary statements to the existing query, enabling the adversary to read sensitive data from the database. The vulnerability is a classic SQL injection issue (CWE‑89) that compromises the confidentiality of application data.

Vulnerable installations are those running the Form Maker by 10Web – Mobile‑Friendly Drag & Drop Contact Form Builder WordPress plugin that are at or below version 1.15.42. Any WordPress site using this plugin copy is affected.

The CVSS score of 7.5 indicates a high severity vulnerability. Because it is unauthenticated, an attacker only needs to send requests to the site, making it remotely exploitable over the Internet. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, but the lack of a KEV listing does not diminish the risk; the flaw remains actively exploitable if the plugin is not updated.