CVE-2026-4703
Received Received - Intake

PHP Object Injection in WS Form LITE WordPress Plugin

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: Wordfence

Description
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-4703
EUVD
EUVD-2026-64521

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ws_form lite to 1.10.80 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a PHP Object Injection flaw in the WS Form LITE WordPress plugin. It allows unauthenticated attackers to inject a PHP object via deserialization of untrusted input from form submission meta values. The impact depends on other installed plugins or themes that might contain a POP chain.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the WS Form LITE plugin in WordPress and verifying its version. Inspect WordPress installations for the plugin directory and check the version in the plugin's main file or WordPress admin panel. No direct commands are provided in the context to detect exploitation attempts.

Impact Analysis

If a POP chain is present in another installed plugin or theme, attackers could delete files, retrieve sensitive data, or execute code on your system. Without a POP chain, the vulnerability has no direct impact.

Mitigation Strategies

Immediately update the WS Form LITE plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Review installed plugins and themes for POP chains that could be exploited in conjunction with this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart