CVE-2026-4703 (CVSS 9.8 CRITICAL): The WS Form LITE

A severe PHP Object Injection vulnerability, tracked as CVE-2026-4703 with a CVSS score of 9.8 (Critical), has been discovered in the WS Form LITE – Drag & Drop Form Builder plugin for WordPress. This flaw affects all versions up to and including 1.10.80. Unauthenticated attackers can exploit this by submitting specially crafted meta values through forms, leading to the deserialization of untrusted input and the injection of PHP objects.

- Vulnerability Type: PHP Object Injection via deserialization of untrusted input. - Affected Plugin: WS Form LITE – Drag & Drop Form Builder for WordPress. - Affected Versions: All versions up to and including 1.10.80. - CVE ID: CVE-2026-4703. - Severity: Critical (CVSS 9.8). - Prerequisite for Impact: Exploitation requires the presence of a "POP chain" (Property Oriented Programming) in another plugin or theme installed on the same WordPress site. - Potential Impact (with POP chain): Arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on the specific POP chain present. - Authentication: Unauthenticated attackers can trigger this vulnerability.

Despite the dependency on an additional plugin or theme providing a POP chain, this vulnerability carries a critical CVSS score for a reason. WordPress powers a massive portion of the internet, and the ecosystem of plugins and themes is vast and often interconnected. The likelihood of a popular site running WS Form LITE alongside another component that inadvertently provides a usable POP chain is non-trivial. When such a chain *is* present, an unauthenticated attacker gains a powerful primitive that could lead directly to full system compromise, data theft, or website defacement. Given the ease of exploitation (unauthenticated form submission) and the potential for remote code execution, this flaw represents a significant risk to any site not yet patched.

- Update Immediately: Ensure your WS Form LITE – Drag & Drop Form Builder plugin is updated to the latest available version beyond 1.10.80. - Audit Plugins/Themes: Review all other installed WordPress plugins and themes for known vulnerabilities that could provide a PHP Object Injection POP chain. - Implement WAF Rules: Deploy Web Application Firewall (WAF) rules to detect and block suspicious input patterns indicative of PHP object deserialization attempts. - Regular Scanning: Conduct routine vulnerability scans of your WordPress installations to identify and remediate outdated or vulnerable components.

This is a summary of reporting by NVD (NIST) . Read the full original article ↗

Get these alerts first.

Every story hits our Telegram channel the moment it publishes.