CVE-2026-4703: CWE-502 Deserialization of Untrusted Data in westguard WS Form LITE – Drag & Drop Contact Form Builder
The WS Form LITE – Drag & Drop Contact Form Builder WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in form submission meta values in all versions up to 1.10.80. This vulnerability requires the presence of a gadget chain (POP chain) in another installed plugin or theme to be exploitable. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, an attacker could potentially delete files, retrieve sensitive data, or execute arbitrary code.
AI Analysis
Technical Summary
CVE-2026-4703 is a PHP Object Injection vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress affecting all versions up to and including 1.10.80. The vulnerability arises from deserialization of untrusted data from form submission meta values, allowing unauthenticated attackers to inject PHP objects. However, no gadget chain (POP chain) is present in the plugin itself, so exploitation depends on the presence of another plugin or theme that contains a suitable POP chain. If such a chain exists, the attacker could leverage it to perform destructive or unauthorized actions such as arbitrary file deletion, data disclosure, or code execution.
Potential Impact
The vulnerability has a critical impact rating (CVSS 9.8) due to the potential for remote unauthenticated attackers to execute arbitrary code or cause significant data loss, but only if a suitable POP chain exists in other installed software. Without a POP chain, the vulnerability cannot be exploited. This conditional impact means the risk depends on the target environment's installed plugins and themes.
Mitigation Recommendations
No official patch or remediation is currently confirmed. Since exploitation requires a POP chain in other installed plugins or themes, review and limit installed third-party plugins/themes to reduce risk. Monitor vendor advisories for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-4703: CWE-502 Deserialization of Untrusted Data in westguard WS Form LITE – Drag & Drop Contact Form Builder
Description
The WS Form LITE – Drag & Drop Contact Form Builder WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in form submission meta values in all versions up to 1.10.80. This vulnerability requires the presence of a gadget chain (POP chain) in another installed plugin or theme to be exploitable. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, an attacker could potentially delete files, retrieve sensitive data, or execute arbitrary code.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4703 is a PHP Object Injection vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress affecting all versions up to and including 1.10.80. The vulnerability arises from deserialization of untrusted data from form submission meta values, allowing unauthenticated attackers to inject PHP objects. However, no gadget chain (POP chain) is present in the plugin itself, so exploitation depends on the presence of another plugin or theme that contains a suitable POP chain. If such a chain exists, the attacker could leverage it to perform destructive or unauthorized actions such as arbitrary file deletion, data disclosure, or code execution.
Potential Impact
The vulnerability has a critical impact rating (CVSS 9.8) due to the potential for remote unauthenticated attackers to execute arbitrary code or cause significant data loss, but only if a suitable POP chain exists in other installed software. Without a POP chain, the vulnerability cannot be exploited. This conditional impact means the risk depends on the target environment's installed plugins and themes.
Mitigation Recommendations
No official patch or remediation is currently confirmed. Since exploitation requires a POP chain in other installed plugins or themes, review and limit installed third-party plugins/themes to reduce risk. Monitor vendor advisories for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-23T23:22:07.759Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a89c252acd9273b4933ffeb
Added to database: 08/22/2026, 15:37:54 UTC
Last enriched: 08/22/2026, 15:52:04 UTC
Last updated: 08/22/2026, 16:11:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.