CVE-2026-4703 describes a PHP Object Injection vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress affecting all versions up to and including 1.10.80. The vulnerability arises from deserialization of untrusted input from form submission meta values, allowing unauthenticated attackers to inject PHP objects. The plugin itself does not contain a POP chain, so exploitation depends on the presence of another plugin or theme with a suitable POP chain on the target system. Successful exploitation could lead to arbitrary file deletion, sensitive data disclosure, or remote code execution depending on the POP chain available.

The vulnerability has a critical impact rating (CVSS 9.8) due to the potential for remote code execution, data disclosure, and file deletion if a POP chain is present in the environment. Without a POP chain, the vulnerability cannot be exploited. This means the impact is conditional on the presence of additional vulnerable components in the WordPress installation.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review installed plugins and themes for known POP chains and consider removing or updating them. Monitoring for updates from the WS Form LITE plugin vendor is recommended.