PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4703 westguard CVE debrief

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted input from form submission meta values. This vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to inject a PHP Object. However, no known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

Vendor
westguard
Product
WS Form LITE – Drag & Drop Contact Form Builder
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-10-12
Advisory published
2026-08-22
Advisory updated
2026-10-12

Who should care

Defenders responsible for WordPress sites using the WS Form LITE – Drag & Drop Contact Form Builder plugin should assess the potential exposure and impact of this vulnerability. This includes verifying the presence of other plugins or themes that could provide a POP chain and prioritizing remediation efforts accordingly.

Why it matters

CVE-2026-4703 is a critical vulnerability in the WS Form LITE plugin for WordPress, allowing PHP Object Injection. Defenders should verify exposure, assess impact, and prioritize remediation to prevent potential code execution or data breaches.

  • Verify potential POP chain presence in other plugins or themes
  • Assess possible code execution or sensitive data retrieval
  • Prioritize remediation based on site-specific risk
  • Monitor for exploitation attempts

Technical summary

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80. The vulnerability is caused by deserialization of untrusted input from form submission meta values. An unauthenticated attacker can exploit this vulnerability to inject a PHP Object. However, the vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

Defensive priority

Defenders should prioritize verifying the presence of other plugins or themes that could provide a POP chain, assessing the potential impact, and applying vendor remediation when available.

Recommended defensive actions

  • Verify the presence of other plugins or themes that could provide a POP chain
  • Assess the potential impact of the vulnerability on the site
  • Apply vendor remediation when available
  • Monitor for potential exploitation attempts
  • Perform a thorough review of site-specific assets and configurations to identify potential exposure
  • Implement compensating controls for exposed systems while remediation is scheduled and verified
  • Track and document remediation efforts and testing results

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. The vulnerability is described as a PHP Object Injection issue in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4703 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4703

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4703 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4703

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.