Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter

An authenticated attacker with administrator-level access sends a crafted HTTP request to one of the plugin's admin AJAX endpoints, supplying a malicious value in the `groupids` parameter. Because the plugin fails to escape the user-supplied parameter and does not use prepared statements, the attacker can append arbitrary SQL clauses to the existing query. This allows extraction of sensitive information from the WordPress database, such as user credentials or other protected data [CWE-89].

The vulnerability resides in the `groupids` parameter handling within the Form Maker plugin's admin AJAX actions. The code at `form-maker.php` registers multiple `wp_ajax_` hooks that route to `form_maker_ajax`, where the `groupids` parameter is used in SQL queries without proper escaping or prepared statement preparation. The patch is not included in the bundle, but the advisory identifies the `groupids` parameter as the injection point.

The advisory states that the fix requires proper escaping of the `groupids` parameter and use of prepared statements in the SQL query. No patch diff is provided in the bundle, so the exact code changes are unknown. The remediation guidance is to upgrade to a patched version where the plugin correctly parameterizes the query and escapes user input before it reaches the database.