The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress contains a PHP Object Injection flaw that deserializes untrusted form data without validation. Unauthorized users can submit payloads that create a PHP object and place it in a form’s meta values. Because the plugin itself does not define a vulnerable class for immediate exploitation, the flaw cannot be used alone to run code or modify system state. However, if another installed plugin or theme provides a class that allows PHP deserialization to instantiate an object (a PHP Object Instantiation, or POP, chain), the payload can trigger destructive actions such as deleting files, exfiltrating data, or executing arbitrary code. Thus the immediate impact is limited, but the presence of a POP chain turns the flaw into a critical vulnerability.

Affected systems include every instance of WS Form LITE released up to and including version 1.10.80. The vulnerability resides in the core form handling logic, so every site running this plugin version is potentially vulnerable. The risk extends to any WordPress installation that also has other plugins or themes supplying vulnerable classes for deserialization, as the injected object would then be able to trigger the POP chain.

The flaw carries a CVSS score of 9.8, indicating a high severity and very high exploitability. EPSS data is not available, so the current exploitation likelihood cannot be quantified precisely. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the flaw by submitting a form; no authentication is required, making the attack vector highly feasible. Successful exploitation depends on the presence of a vulnerable POP chain in the target environment, but once such a chain exists, the attacker can achieve privilege escalation, data theft, or system compromise.