CVE-2026-3330

OVERVIEW CVE-2026-3330 is a SQL Injection vulnerability affecting the Form Maker by 10Web plugin for WordPress in all versions up to and including 1.15.40. The flaw exists in the handling of user input parameters (ip_search, startdate, enddate, username_search, and useremail_search) which are directly concatenated into SQL queries without proper sanitization or prepared statements. The vulnerability is compounded by improper input validation that strips WordPress security protections and a missing CSRF token verification, enabling exploitation via social engineering. SEVERITY The vulnerability requires authentication with Administrator-level privileges to exploit, limiting the attack surface to trusted internal users or those with administrative credentials. However, the missing nonce verification allows attackers to trigger the SQL Injection through Cross-Site Request Forgery by deceiving an administrator into clicking a malicious link. The attack has a CVSS severity rating of 4.9 (Medium) with high confidentiality impact, allowing extraction of sensitive database information. The network attack vector and low complexity indicate the flaw is relatively straightforward to exploit once authentication requirements are met. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The Exploit Prediction Scoring Engine (EPSS) score of 0.00017 is significantly lower than the global average, suggesting minimal real-world exploitation likelihood. Community attention remains minimal, with the vulnerability inactive on threat intelligence hot lists. Organizations should prioritize patching to version 1.15.41 or later, though the low exploitation probability allows for measured remediation timelines.