An unauthenticated PHP Object Injection vulnerability in the WS Form LITE WordPress plugin could lead to remote code execution if a compatible POP chain is present on the system.

The plugin performs insecure deserialization of untrusted user input within form submission meta values (CWE-502). While the plugin itself does not contain a POP chain, the vulnerability allows unauthenticated attackers to trigger malicious object instantiation if other installed components provide the necessary gadget chains.

With a CVSS score of 9.8, this vulnerability is critical. If a viable POP chain exists within the WordPress installation, an attacker could achieve arbitrary file deletion, data retrieval, or remote code execution, leading to a complete compromise of the site and its hosted data.

Immediate Action: Update the WS Form LITE plugin to version 1.10.82 or later immediately.

Proactive Monitoring: Monitor site activity for unusual file system changes or unauthorized data access that might indicate the successful execution of an injected PHP object.

Compensating Controls: Utilize a WordPress-specific WAF to filter malicious serialized PHP objects from incoming form submissions and block requests targeting known plugin endpoints.

Public Exploit Available: Unknown.

Despite the dependency on external gadget chains, the severity of this vulnerability necessitates a prompt update. Administrators should treat this as a high-priority patch to eliminate the risk of potential remote code execution.