Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter

An attacker with administrator-level access to the WordPress admin panel sends a crafted request containing malicious SQL in the 'name' parameter. The plugin's insufficient escaping and lack of prepared statement preparation [ref_id=1] cause the injected SQL to be appended to the existing query, enabling extraction of sensitive database contents. The attack requires authentication and admin privileges, but no special network position beyond standard HTTP access to the admin dashboard.

The vulnerability resides in the Form Maker plugin's handling of the 'name' parameter within the admin-facing SQL query logic. The code at `form-maker.php` (around line 911) and the associated `WDW_FM_Library` class fail to properly escape and prepare user-supplied input before incorporating it into SQL statements. The advisory confirms that insufficient escaping and lack of prepared statements in the SQL query allow an authenticated administrator to inject arbitrary SQL via the 'name' parameter.

The advisory does not include a patch diff, but the recommended fix is to properly escape the 'name' parameter and use prepared statements (parameterized queries) in the SQL query. Without a published patch, the vendor would need to replace the vulnerable direct string interpolation with a prepared statement that binds the 'name' value safely, preventing any injected SQL from being executed.