EUVD-2026-40915
GHSA-44m6-x3f3-q98j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible settings endpoint, no interaction needed, but subscriber-level auth required (PR:L); only plugin settings integrity is affected, no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.
AnalysisAI
Missing capability check in WS Form LITE WordPress plugin before 1.11.8 allows any authenticated subscriber-level WordPress user to modify the plugin's settings, an action that should be restricted to administrators. The CVSS vector (PR:L) confirms low-privilege authentication is sufficient, and a publicly available proof-of-concept has been documented by WPScan. No active exploitation has been confirmed by CISA KEV, but the low barrier to exploitation and available POC make this a credible risk on multi-user WordPress installations where untrusted subscribers exist.
Technical ContextAI
WS Form LITE is a WordPress form-builder plugin. WordPress enforces access control to privileged operations via capability checks (e.g., current_user_can()), which gate settings-update AJAX or REST actions to users with appropriate roles. The affected code path omits this check entirely, meaning any logged-in user - regardless of role - can invoke the settings-update action. This is a classic instance of missing authorization (functionally equivalent to CWE-862), though NVD lists CWE as N/A in this entry. The affected CPE is cpe:2.3:a:unknown:ws_form_lite:*:*:*:*:*:*:*:* covering all versions before 1.11.8. The tag 'Information Disclosure' in the source data appears to be a mislabeling - the CVSS vector assigns C:N (no confidentiality impact), and the description describes a settings-write action, not data read.
RemediationAI
Vendor-released patch: upgrade WS Form LITE to version 1.11.8 or later, which introduces the missing capability check on the affected settings-update action. The fix is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/. If immediate upgrade is not possible, a compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber-level accounts. Note that this workaround does not protect sites where subscriber accounts have already been issued to untrusted users. There is no known impact on form functionality from upgrading to 1.11.8.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today