CVE-2026-11562 describes an improper authentication vulnerability in the WS Form LITE WordPress plugin prior to version 1.11.8. The plugin does not enforce capability checks on one of its settings-update actions, enabling any authenticated user with subscriber-level privileges or above to modify the plugin's settings. This could lead to unauthorized configuration changes, though it does not directly impact confidentiality or availability. The vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS 3.1 score of 4.3, reflecting a low complexity attack vector but limited impact on confidentiality and availability.

Authenticated users with subscriber-level access or higher can modify WS Form LITE plugin settings without proper authorization checks. This could lead to unauthorized changes in plugin behavior or configuration but does not directly compromise data confidentiality or availability according to the CVSS vector. There is no indication of remote unauthenticated exploitation or privilege escalation beyond subscriber-level access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and monitor for unusual configuration changes. Avoid granting subscriber-level access to untrusted users. Follow vendor updates closely for an official patch or temporary mitigation.