The Form Maker plugin for WordPress contains a blind SQL injection flaw tied to the 'inputs' parameter. Unsanitized user input and the absence of prepared statements allow attackers to inject arbitrary SQL, enabling retrieval of database contents such as user data or configuration settings. This vulnerability aligns with CWE‑89 and permits data exfiltration without requiring authentication.

All installations of the 10Web Form Maker – Mobile‑Friendly Drag & Drop Contact Form Builder that are at or below version 1.15.48 are vulnerable. The flaw impacts WordPress sites using this plugin in any environment, regardless of the hosting infrastructure or site role, as the nonce needed for the vulnerable endpoint is exposed on every public form page.

The CVSS score of 7.5 denotes a high severity risk. The EPSS score of less than 1% indicates a low but present probability of exploitation, and the vulnerability is not yet catalogued in the CISA KEV list. Because and the nonce is publicly discoverable, the query can be targeted by any visitor. Exploitation involves crafting malicious contents for the 'inputs' field; the lack of feedback necessitates blind exploitation, but the public exposure of the parameter simplifies the attacker’s task.