CVE-2026-4703: CWE-502 Deserialization of Untrusted Data in westguard WS Form LITE – Drag & Drop Contact Form Builder

CVE-2026-4703 is a critical PHP Object Injection vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress, affecting all versions up to and including 1.10.80. The vulnerability arises from deserialization of untrusted input in form submission meta values, enabling unauthenticated attackers to inject PHP objects. No gadget chain (POP chain) is present in the plugin itself, so exploitation depends on the presence of another plugin or theme with a POP chain on the target system. If such a POP chain exists, attackers may leverage it to perform destructive or unauthorized actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

The vulnerability has a critical impact rating (CVSS 9.8) due to the potential for remote unauthenticated attackers to execute arbitrary code or delete files if a suitable POP chain is present in other installed plugins or themes. Without a POP chain, the vulnerability cannot be exploited. Therefore, the impact depends on the target environment's installed components beyond the vulnerable plugin itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review installed plugins and themes for known POP chains and consider disabling or removing untrusted components. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.