WS Form LITE – Drag & Drop Contact Form Builder: insecure deserialization
WS Form LITE – Drag & Drop Contact Form Builder
Insecure deserialization in the WS Form LITE – Drag & Drop Contact Form Builder component. Threat level: Critical (CVSS 9.8).
Who is affected
This vulnerability affects: WS Form LITE – Drag & Drop Contact Form Builder. If you use this component on your site, check the version and update it as soon as possible.
How dangerous
Rating: Critical, CVSS 9.8 out of 10. Critical flaws are often exploited en masse within hours of disclosure.
What this flaw is
Insecure deserialization processes input as ready-made objects. With a faulty implementation, this can run code or alter the application logic.
In practice it often leads to remote code execution, i.e. a site takeover.
Score breakdown (CVSS vector)
What the CVSS 9.8 rating means in practice:
- The attack can be carried out remotely, over the internet.
- No login or account required.
- Requires no action from the victim.
- At risk: data confidentiality, integrity (data can be altered), site availability.
Weakness class: CWE-502.
What to do
- Update the vulnerable component (WS Form LITE – Drag & Drop Contact Form Builder) to the latest version.
- If a patch is not out yet, temporarily disable the vulnerable element.
- Check whether the site has already been attacked: unusual files, new administrator accounts, redirects.
- Make a backup before you start making changes.
Does this flaw affect your site?
We will run a free audit: we check versions, plugins, and configuration, and tell you plainly whether you are safe.
Request a free audit →