Is CVE-2026-4703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4703 being exploited in the wild.

How severe is CVE-2026-4703?

Critical severity, with a CVSS score of 9.8, published 22 August 2026.

Is there a fix for CVE-2026-4703?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4703 attacked?

It is attacked over the network.

Am I affected by CVE-2026-4703?

Check whether you run WS Form LITE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4703: WS Form LITE PHP Object Injection in form submission

CVE-2026-4703 · Severity: critical · CVSS 9.8 · Published 2026-08-22

WS Form LITE is a WordPress plugin used to build contact forms and collect user submissions. The plugin deserializes untrusted data from form submissions without validation, allowing attackers to inject malicious PHP objects. While the plugin itself contains no exploitable code path, if other vulnerable plugins or themes are installed, attackers could leverage them to delete files, steal data, or execute arbitrary code on the server.

Technologies: WS Form LITE. Vendors: WS Form.

Quick answers

Is CVE-2026-4703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4703 being exploited in the wild.
How severe is CVE-2026-4703?: Critical severity, with a CVSS score of 9.8, published 22 August 2026.
Which products and versions are affected?: WS Form LITE up to 1.10.80.
Is there a fix for CVE-2026-4703?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4703 attacked?: It is attacked over the network.
Am I affected by CVE-2026-4703?: Check whether you run WS Form LITE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a PHP Object Injection (deserialization) flaw in form submission meta value handling across all versions up to 1.10.80. Unauthenticated attackers can inject arbitrary serialized PHP objects through form fields, which are then unserialized without proper validation. The attack requires no authentication and is network-accessible via form submission. The vulnerability has no direct impact in isolation, but becomes critical if a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, potentially allowing arbitrary file deletion, information disclosure, or remote code execution.

Affected products

WS Form WS Form LITE up to 1.10.80

Timeline

2026-08-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.