A security flaw tracked as CVE-2026-4703 has been found in the free WS Form drag-and-drop contact form builder plugin for WordPress, impacting all versions up to and including 1.10.80. The issue allows unauthenticated attackers (people who do not have valid login access to your website) to send specially crafted form submissions that can inject harmful PHP objects into your site's system via the plugin's processing of form submission data.
This vulnerability cannot be exploited on its own, as there is no built-in harmful code path in the WS Form plugin itself to turn the injected object into a damaging action. It only poses a risk if you have another WordPress plugin or theme installed on your site that contains a specific type of vulnerable code called a POP chain. If such an additional vulnerable tool is present, an attacker could use this flaw to delete arbitrary files, access sensitive private data, or run unauthorized code on your site, with the exact possible actions depending on the functionality of the other vulnerable plugin or theme.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-4703
