{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ws-form/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-4703"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WS Form LITE (\u003c= 1.10.80)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WS Form"],"content_html":"\u003cp\u003eThe WS Form LITE plugin for WordPress, specifically versions 1.10.80 and earlier, contains a critical PHP Object Injection vulnerability (CVE-2026-4703). The issue stems from the unsafe deserialization of untrusted user input within form submission meta values. While the plugin does not ship with a native Property-Oriented Programming (POP) chain, attackers can leverage this deserialization primitive to trigger arbitrary file deletion, data exfiltration, or remote code execution (RCE) if other installed plugins or themes provide the necessary gadgets. Because this can be triggered by unauthenticated users, the attack surface includes any WordPress instance using the affected version of the plugin, provided the hosting environment contains vulnerable gadgets in the broader plugin ecosystem.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation requires a secondary POP chain to be present on the target WordPress site. If such a chain exists, the impact includes full site compromise, unauthorized data access, and persistent code execution, depending on the capabilities of the available gadgets. The severity is high due to the potential for unauthenticated access to the deserialization routine.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the WS Form LITE plugin to the latest version immediately to remediate the unsafe deserialization entry point. Detection teams should audit WordPress environments for the presence of the vulnerable plugin version using vulnerability management tools. Monitor server access logs for unusual POST requests directed at form submission endpoints that deviate from expected patterns, particularly those containing serialized PHP data structures. Ensure all installed plugins and themes are audited to identify and remove any components that contain dangerous POP chain gadgets.\u003c/p\u003e\n","date_modified":"2026-08-22T17:31:56Z","date_published":"2026-08-22T17:31:56Z","id":"https://feed.craftedsignal.io/briefs/2026-08-ws-form-injection/","summary":"The WS Form LITE plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via unsanitized form submission meta values, potentially leading to RCE or data exfiltration if combined with a secondary POP chain.","title":"PHP Object Injection in WS Form LITE","url":"https://feed.craftedsignal.io/briefs/2026-08-ws-form-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - WS Form","version":"https://jsonfeed.org/version/1.1"}