Description
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Form Maker by 10Web | < 1.15.45 | 1.15.45 |
References
- https://wpscan.com/vulnerability/70430b75-9b5e-4f47-8b37-7be1da5ba063/ exploit vdb-entry technical-description