SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-4703 2026-08-22

CVE-2026-4703: Unauthenticated PHP Object Injection in WS Form LITE for WordPress

"A critical deserialization flaw in the WS Form LITE contact form builder lets unauthenticated attackers inject arbitrary PHP objects into WordPress sites running version 1.10.80 or earlier."

A critical deserialization flaw in the WS Form LITE contact form builder lets unauthenticated attackers inject arbitrary PHP objects into WordPress sites running version 1.10.80 or earlier.

What Is It

CVE-2026-4703 is a PHP Object Injection vulnerability (CWE-502) in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress, published by Wordfence on 2026-08-22. The plugin deserializes untrusted input drawn from form submission meta values, allowing an unauthenticated attacker to supply a crafted serialized payload and instantiate arbitrary PHP objects in the application context.

The vulnerable code paths are identified in includes/class-ws-form-common.php (line 7154) and includes/core/class-ws-form-submit.php (line 1061).

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.

The practical severity, however, is conditional. Wordfence notes that no known POP (Property Oriented Programming) chain exists inside the vulnerable plugin itself, so object injection alone has no impact on a site running WS Form LITE in isolation. If any other installed plugin or theme supplies a usable POP chain, the picture changes: an attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code, depending on what that chain permits. Whether that precondition is met on any given site depends on the specific plugins and themes installed alongside WS Form LITE, and the supplied data does not indicate how commonly that combination occurs in practice. Operators are best positioned to assess their own exposure by inventorying what else is running on the site.

There is no CISA KEV entry for this CVE in the supplied data, and no confirmation of active exploitation.

What's Vulnerable

Patch Status

A fix has been committed to the plugin's public repository; WordPress.org plugin changeset 3489609 addresses the deserialization path. Site operators running 1.10.80 or earlier should update WS Form LITE to a patched release. The NVD record is in Received status as of 2026-08-22 and carries no CISA-mandated remediation deadline.

Sources