WS Form - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/ws-form/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 22 Aug 2026 17:31:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPHP Object Injection in WS Form LITEhttps://feed.craftedsignal.io/briefs/2026-08-ws-form-injection/Sat, 22 Aug 2026 17:31:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ws-form-injection/The WS Form LITE plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via unsanitized form submission meta values, potentially leading to RCE or data exfiltration if combined with a secondary POP chain.The WS Form LITE plugin for WordPress, specifically versions 1.10.80 and earlier, contains a critical PHP Object Injection vulnerability (CVE-2026-4703). The issue stems from the unsafe deserialization of untrusted user input within form submission meta values. While the plugin does not ship with a native Property-Oriented Programming (POP) chain, attackers can leverage this deserialization primitive to trigger arbitrary file deletion, data exfiltration, or remote code execution (RCE) if other installed plugins or themes provide the necessary gadgets. Because this can be triggered by unauthenticated users, the attack surface includes any WordPress instance using the affected version of the plugin, provided the hosting environment contains vulnerable gadgets in the broader plugin ecosystem.

Impact

Successful exploitation requires a secondary POP chain to be present on the target WordPress site. If such a chain exists, the impact includes full site compromise, unauthorized data access, and persistent code execution, depending on the capabilities of the available gadgets. The severity is high due to the potential for unauthenticated access to the deserialization routine.

Recommendation

Update the WS Form LITE plugin to the latest version immediately to remediate the unsafe deserialization entry point. Detection teams should audit WordPress environments for the presence of the vulnerable plugin version using vulnerability management tools. Monitor server access logs for unusual POST requests directed at form submission endpoints that deviate from expected patterns, particularly those containing serialized PHP data structures. Ensure all installed plugins and themes are audited to identify and remove any components that contain dangerous POP chain gadgets.

]]>highadvisory