CVE-2026-4703

Deferred Deferred - Pending Action

PHP Object Injection in WS Form LITE WordPress Plugin

Publication date: 2026-08-22

Last updated on: 2026-08-24

Assigner: Wordfence

Description

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-24

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-4703

EUVD

EUVD-2026-64521

Affected Vendors & Products

Vendor	Product	Version / Range
ws_form	lite	to 1.10.80 (inc)
ws_form	ws_form_lite	to 1.10.80 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP Object Injection flaw in the WS Form LITE WordPress plugin. It allows unauthenticated attackers to inject a PHP object via deserialization of untrusted input from form submission meta values. The impact depends on other installed plugins or themes that might contain a POP chain.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the WS Form LITE plugin in WordPress and verifying its version. Inspect WordPress installations for the plugin directory and check the version in the plugin's main file or WordPress admin panel. No direct commands are provided in the context to detect exploitation attempts.

Impact Analysis

If a POP chain is present in another installed plugin or theme, attackers could delete files, retrieve sensitive data, or execute code on your system. Without a POP chain, the vulnerability has no direct impact.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR or HIPAA if an attacker exploits it to retrieve sensitive data or execute code. Unauthorized access to personal data may violate GDPR principles, while exposure of protected health information could breach HIPAA requirements. The impact depends on whether a POP chain exists in other installed plugins or themes.

Mitigation Strategies

Immediately update the WS Form LITE plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Review installed plugins and themes for POP chains that could be exploited in conjunction with this vulnerability.

Hi! I’m here to help you understand CVE-2026-4703. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70