CVE-2026-11562: WS Form LITE Auth Bypass Vulnerability

CVE-2026-11562 Overview

CVE-2026-11562 affects the WS Form LITE WordPress plugin in versions prior to 1.11.8. The plugin lacks a capability check on one of its settings-update actions. Authenticated users with subscriber-level access or higher can modify plugin settings without proper authorization. This is a broken access control vulnerability [CWE-862] that lowers the barrier for low-privileged accounts to alter plugin configuration on affected WordPress sites.

Critical Impact
Subscriber-level accounts can modify WS Form LITE plugin settings, enabling unauthorized configuration changes on affected WordPress sites.

Affected Products

WS Form LITE WordPress plugin versions before 1.11.8
WordPress sites permitting subscriber-level registration with the plugin installed
WordPress installations using WS Form LITE for form management

Discovery Timeline

2026-07-01 - CVE-2026-11562 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-11562

Vulnerability Analysis

WS Form LITE exposes a settings-update action that does not verify the caller's WordPress capability. WordPress role-based access control relies on current_user_can() checks inside privileged actions. When those checks are missing, any authenticated user, regardless of role, can trigger the action.

The vulnerability requires an authenticated session at subscriber level or higher. Subscribers are the lowest privileged role in WordPress and often exist on sites that permit open user registration. The flaw allows those accounts to modify WS Form LITE settings that should be restricted to administrators.

The impact is limited to integrity of plugin configuration. Confidentiality and availability are not directly affected based on the reported CVSS metrics. However, altered settings can degrade form behavior or open follow-on attack paths depending on the modified options.

Root Cause

The root cause is a missing authorization check on a settings-update handler. The action processes requests from any authenticated user without validating that the caller holds an administrative capability such as manage_options.

Attack Vector

An attacker registers or obtains a subscriber-level account on the target WordPress site. The attacker then sends a crafted request to the vulnerable settings-update action, supplying modified plugin settings. WordPress accepts the request and persists the changes because the handler does not enforce role restrictions.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-11562

Indicators of Compromise

Unexpected changes to WS Form LITE plugin settings recorded in the WordPress database or audit logs
Requests to WS Form LITE admin-ajax or admin-post settings endpoints originating from subscriber-level accounts
Recent subscriber account registrations followed by POST requests to plugin settings actions

Detection Strategies

Audit WordPress access logs for POST requests to admin-ajax.php or admin-post.php referencing WS Form LITE actions from non-administrator sessions
Compare current WS Form LITE settings against a known-good baseline to detect unauthorized modifications
Enable a WordPress security plugin or audit log to track configuration changes and their originating user roles

Monitoring Recommendations

Monitor creation of new subscriber accounts, especially on sites with open registration enabled
Alert on any settings modification performed by non-administrator roles
Review plugin update status regularly to confirm all sites are running WS Form LITE 1.11.8 or later

How to Mitigate CVE-2026-11562

Immediate Actions Required

Update WS Form LITE to version 1.11.8 or later on all WordPress installations
Review and revert any unauthorized changes to WS Form LITE settings
Audit user accounts and remove unnecessary subscriber-level accounts

Patch Information

Upgrade WS Form LITE to version 1.11.8 or later. The vendor advisory is available via the WPScan Vulnerability Report.

Workarounds

Disable open user registration in WordPress general settings if not required
Temporarily deactivate the WS Form LITE plugin until the patched version can be deployed
Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php via web application firewall rules that block subscriber-role requests targeting WS Form LITE actions

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# Update the plugin to the patched version
wp plugin update ws-form --version=1.11.8