What is the CVSS score of CVE-2026-4703?

CVE-2026-4703 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate CVE-2026-4703?

Within 24 hours, identify all WordPress instances running WS Form LITE version 1.10.80 or earlier and document their plugin/theme configurations. Within 7 days, deploy a replacement form plugin (WP Forms, Gravity Forms, Formidable Forms, or similar maintained alternatives) or disable WS Form LITE if form functionality is non-critical; obtain leadership risk acceptance in writing if replacement cannot complete within 7 days. Within 30 days, fully migrate all form submissions away from WS Form LITE and confirm no instances of versions ≤1.10.80 remain active.

WS Form LITE CVE-2026-4703

EUVD-2026-64521 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-22 Wordfence

GHSA-hpc2-mqfw-fq4q

PHP WordPress Information Disclosure Deserialization Wordpress Plugin Ws Form Lite Drag Drop Contact Form Builder

9.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Locate site running WS Form LITE ≤1.10.80
Delivery

Submit form with serialized PHP object in meta value
Exploit

Plugin deserializes untrusted input
Execution

Injected object triggers co-installed POP gadget
Impact

Delete files, read secrets, or execute code

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target WordPress site have at least one OTHER installed plugin or theme that provides a usable PHP POP (gadget) chain - WS Form LITE alone contains none, so on a clean install the injection has no impact. The attacker must be able to reach a WS Form submission endpoint and supply serialized input in a form-submission meta value (up to and including plugin version 1.10.80). No authentication is required (PR:N) and no user interaction is needed (UI:N); the primary limiting factor is the mandatory presence of an external POP chain, which makes practical impact site-specific rather than universal.
Impact	The signals conflict and must be read together. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) scores the theoretical worst case: unauthenticated network object injection. However, the description itself states there is no impact unless a separate plugin or theme provides a POP chain, which is an external attack requirement not reflected in the base score - realistically this raises attack complexity. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation. Net: this is not a drop-everything issue for a hardened, minimal WordPress install, but sites running many plugins/themes (the norm) have a meaningful chance of harboring an exploitable gadget, so it should be patched promptly rather than deprioritized purely on the 'no POP chain' caveat.
Exploit ScenarioDerived	An unauthenticated attacker submits a WS Form form (or crafts an equivalent POST) placing a serialized PHP object into a submission meta value; the plugin deserializes it, instantiating an attacker-chosen object. If a co-installed plugin or theme supplies a matching gadget chain, the object's magic methods fire during processing to, for example, delete a configuration file or read wp-config secrets. Given AV:N/AC:L/PR:N/UI:N the delivery is trivial and remote, but success hinges on a suitable gadget being present; no public POC was identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 22, 2026

PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.

RemediationAI

Upstream fix available (WordPress plugin SVN changeset 3489609); a released patched version above 1.10.80 is not independently confirmed from the provided data, so update WS Form LITE to the latest available version from the WordPress plugin repository as the primary remediation and verify the installed version is newer than 1.10.80. If immediate patching is not possible, reduce exposure by auditing and removing or updating other installed plugins and themes to eliminate exploitable POP gadget chains (this is what turns the injection into real impact), and consider a WAF rule to block serialized PHP objects (strings matching patterns like O:<n>: or a:<n>:) in form-submission POST bodies - noting this may break legitimate submissions that carry serialized data. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/df36eae9-6f2b-432c-a765-57450939b344?source=cve) for updated fix details.

Affected VersionsENISA

WS Form LITE – Drag & Drop Contact Form Builder 0 ≤1.10.80

Affected Packages

euvd ws_form_lite_drag_drop_contact_form_builder no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a CWE-502 (Deserialization of Untrusted Data) issue in WestGuard's WS Form LITE (cpe:2.3:a:westguard:ws_form_lite_-_drag_&_drop_contact_form_builder). PHP's unserialize() reconstructs objects from a serialized string; if attacker-controlled input reaches it, an attacker chooses which class is instantiated and controls its properties. When those objects are destroyed or used, their magic methods (__wakeup, __destruct, __toString, etc.) fire - a 'POP chain' - potentially triggering file operations, SQL, or command execution. The referenced source (class-ws-form-submit.php around line 1061 and class-ws-form-common.php around line 7154) shows submission meta values being deserialized. Because WS Form itself contains no such gadget, this is a classic 'object injection sink without a local gadget,' making it a building block that becomes dangerous only in combination with third-party code common in the WordPress ecosystem.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.1 HIGH

Network, unauthenticated object injection (AV:N/PR:N/UI:N), but impact depends on an external POP chain being present, an attack condition that raises complexity to AC:H; full C/I/A when a gadget exists.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The WS Form LITE - Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Articles & Coverage 1

News Critical PHP Object Injection in WS Form LITE for WordPress - CVE-2026-4703 Aug 23, 2026

Executive ViewAI

Why It Matters

WS Form LITE for WordPress (versions ≤1.10.80) contains a PHP Object Injection vulnerability permitting unauthenticated remote code execution if the WordPress installation contains gadget chains in other plugins or themes. No public exploit identified at time of analysis, but organizations should treat this plugin removal as a priority given the severe 9.8 CVSS and supply-chain attack nature of the risk.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable WS Form LITE if business operations permit; implement Web Application Firewall (WAF) rules to block or log form submissions containing serialized PHP object patterns; remove or update unused plugins and themes to minimize gadget chain availability; monitor application logs for PHP unserialization warnings or errors.

Threat Intelligence Overview

EPSS Score

0.9%

Top 43% exploitable

Prevalence

Medium

moderately popular WordPress contact form plugin, not ecosystem-dominant

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.9%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.