Is CVE-2026-11562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11562 being exploited in the wild.

How severe is CVE-2026-11562?

Informational severity, with a CVSS score of 4.3, published 1 July 2026.

Is there a fix for CVE-2026-11562?

A patch was published on 2026-06-10: Fixed in version 1.11.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11562 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11562?

Check whether you run WS Form LITE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11562: WS Form LITE unauthorized settings update via missing capability check

CVE-2026-11562 · Severity: info · CVSS 4.3 · Published 2026-07-01

WS Form LITE, a popular WordPress plugin used for creating website forms, contains a security flaw that allows low-privileged users (such as subscribers) to modify the plugin's settings. An attacker with a basic account could change critical configurations, including spam protection keys (reCAPTCHA) and Google Maps API settings. This could lead to the bypass of security controls or the disruption of form functionality on the affected website.

Technologies: WS Form LITE. Vendors: WS Form.

Quick answers

Is CVE-2026-11562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11562 being exploited in the wild.
How severe is CVE-2026-11562?: Informational severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?: WS Form LITE before 1.11.8.
Is there a fix for CVE-2026-11562?: A patch was published on 2026-06-10: Fixed in version 1.11.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11562 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11562?: Check whether you run WS Form LITE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WS Form LITE plugin for WordPress fails to implement adequate authorization checks (capability checks) on the 'wsf-settings-update' action. While the plugin uses a nonce for CSRF protection, this nonce is exposed to all logged-in users, including those with the 'Subscriber' role. An authenticated attacker can retrieve this nonce from the WordPress dashboard and send a crafted POST request to 'wp-admin' to overwrite plugin settings. Impacted settings include reCAPTCHA keys, Google Maps API keys, and IP-lookup URLs. The issue is resolved in version 1.11.8.

Affected products

WS Form WS Form LITE before 1.11.8

Timeline

2026-06-10: disclosed: Publicly published by WPScan
2026-06-10: patched: Fixed in version 1.11.8
2026-07-01: advisory: NVD published date

References

https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.