CVE-2026-11562

MediumCVSS 4.3/10Last modified Jul 1, 2026

Description

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	WS Form LITE	< 1.11.8

References

https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/

Timeline

Published: Jul 1, 2026
Last modified: Jul 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a CVE-2026-115649.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy CVE-2026-115658.5The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions,CVE-2026-1156574.8When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured cre CVE-2026-115675.9The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variabl CVE-2026-115687.5The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before return CVE-2026-115695.4A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository wri CVE-2026-11578.8A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecg CVE-2026-115704.2The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured dis CVE-2026-115717.5The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing CVE-2026-115728.8Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of