CVE-2026-11562 describes an improper authentication vulnerability in the WS Form LITE WordPress plugin prior to version 1.11.8. The plugin fails to enforce capability checks on one of its settings-update actions, enabling any authenticated user with subscriber-level privileges or above to modify plugin settings. This could lead to unauthorized configuration changes, potentially impacting the plugin's behavior or security posture. No evidence of known exploits in the wild has been reported. The vulnerability does not affect confidentiality or availability but impacts integrity due to unauthorized modification capabilities.

An attacker with subscriber-level access or higher can modify WS Form LITE plugin settings without proper authorization. This unauthorized modification could lead to altered plugin behavior or security misconfigurations. There is no direct impact on confidentiality or availability reported.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor's advisory for updates and apply the official fix once it becomes available. Until then, restricting user roles and minimizing subscriber-level access may reduce exposure.