Executive brief
WS Form LITE, a popular WordPress plugin used for creating website forms, contains a security flaw that allows low-privileged users (such as subscribers) to modify the plugin's settings. An attacker with a basic account could change critical configurations, including spam protection keys (reCAPTCHA) and Google Maps API settings. This could lead to the bypass of security controls or the disruption of form functionality on the affected website.
Technical details
The WS Form LITE plugin for WordPress fails to implement adequate authorization checks (capability checks) on the 'wsf-settings-update' action. While the plugin uses a nonce for CSRF protection, this nonce is exposed to all logged-in users, including those with the 'Subscriber' role. An authenticated attacker can retrieve this nonce from the WordPress dashboard and send a crafted POST request to 'wp-admin' to overwrite plugin settings. Impacted settings include reCAPTCHA keys, Google Maps API keys, and IP-lookup URLs. The issue is resolved in version 1.11.8.
Affected products
- WS Form WS Form LITE before 1.11.8
Timeline
- 2026-06-10: disclosed: Publicly published by WPScan
- 2026-06-10: patched: Fixed in version 1.11.8
- 2026-07-01: advisory: NVD published date