Security Alert Summary
The WS Form LITE WordPress plugin before 1.11.8 lacks a capability check on a settings-update action. This allows authenticated users with subscriber-level access and above to modify the plugin’s settings, potentially leading to unauthorized changes to form configuration.
CVE Details
- CVE ID: CVE-2026-11562
- Affected component: WS Form LITE WordPress plugin
- Affected versions: Versions before 1.11.8 (less than 1.11.8)
- Published: July 1, 2026 at 7:16:21 AM UTC
- Last modified: July 1, 2026 at 11:16:22 AM UTC
- CVSS v3.1: Base score 4.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated user with low privileges (subscriber-level or higher). No user interaction is required.
- Primary impact: Confidentiality: None; Integrity: Low (unauthorized changes to settings); Availability: None
- CWE / weakness: None specified in the provided data
Technical Details
The vulnerability is a missing capability check on one of the plugin’s settings-update actions. Because the plugin does not verify that the acting user has the appropriate capabilities, authenticated users with subscriber-level access and above can perform the settings-update action and modify the WS Form LITE plugin settings.
The description specifically references a settings-update action but does not name particular functions or REST endpoints. The root cause is a lack of an authorization check on that settings-update workflow. The practical result is an integrity impact: settings can be changed by users who should not have that capability.
How This Could Impact Your Website
Consider a small team managing a WordPress site: the site owner, an internal editor, and an external contractor who contributes content using a subscriber or contributor account. If one of those lower-privileged accounts can change WS Form LITE settings, an attacker who compromises or leverages one of those accounts could alter form behavior or notification targets.
While the CVSS data indicates no direct confidentiality impact, unauthorized modification of plugin settings could indirectly increase the risk of exposing contact information or workflow details, which in turn could raise the risk of targeted phishing or social engineering against staff. The most realistic outcome supported by the data is unauthorized configuration changes rather than full site compromise.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and subscriber accounts that have more access than required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and plugin configuration changes for unusual behavior.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
