CVE-2026-11562

MEDIUM

WS Form LITE < 1.11.8 - Subscriber+ Arbitrary Settings Update

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11562. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-11562, a missing capability check in the WS Form LITE WordPress plugin (before 1.11.8). The code includes placeholder logic for network probing but lacks actual exploit implementation for modifying plugin settings.

Description

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-11562_the_form_lite.py

This repository contains an auto-generated stub module for CVE-2026-11562, a missing capability check in the WS Form LITE WordPress plugin (before 1.11.8). The code includes placeholder logic for network probing but lacks actual exploit implementation for modifying plugin settings.

Classification
Stub 98%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: WS Form LITE WordPress plugin before 1.11.8
Auth required
Prerequisites: Subscriber-level or higher WordPress credentials · Target must be running vulnerable WS Form LITE plugin version
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/

Scores

CVSS v3 4.3
EPSS 0.0016
EPSS Percentile 5.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

Status published
Products (1)
None/WS Form LITE < 1.11.8
Published Jul 01, 2026
Tracked Since Jul 01, 2026