WordPress plugin vulnerabilities: 12 plugins including WS Form LITE

Vulnerabilities in 12 WordPress plugins were disclosed on 7 November 2026. The most serious is a privilege escalation in Registration Form for WooCommerce (CVSS 9.8) that allows unauthenticated attackers to create an administrator account. Several other flaws can also be exploited without an account, under conditions described below. None of them is reported as actively exploited so far.

Registration Form for WooCommerce (1,000 active installations)

The checkout registration path does not check the submitted user role against an allow-list, so unauthenticated attackers can create an account with the Administrator role during checkout, which amounts to a full site takeover. All versions up to and including 1.1.4 are affected (CVE-2026-119075, CVSS 9.8). Update to the latest version; if no update is available, deactivate and remove the plugin.

QA Assistants – Driven by data (2,000 active installations)

This plugin is vulnerable to PHP Object Injection via the 'dlevent_ver' parameter, which unauthenticated attackers can use together with a bundled Guzzle component to write arbitrary files and potentially execute code. The vulnerable code is triggered through wp-cron.php, which requires no authentication and runs on a two-minute schedule. All versions up to and including 5.3.0 are affected (CVE-2026-87112, CVSS 8.8). Update to the latest version, or deactivate and remove the plugin if no update is available.

Advanced Form Integration – Connect Forms to 300+ Apps (9,000 active installations)

Unauthenticated attackers can inject PHP objects through deserialization of untrusted input. The plugin itself contains no known POP chain, so impact depends on another plugin or theme providing one, and exploitation requires an active NexForms integration configured by an administrator. All versions up to and including 2.10.2 are affected (CVE-2026-104738, CVSS 8.1). Update to the latest version, or deactivate and remove the plugin if no update is available.

Motors – Car Dealership & Classified Listings Plugin (9,000 active installations)

Any logged-in user with subscriber-level access or higher can delete arbitrary files via the stm_listings_ajax_save_user_data function; according to the description, deletion is limited to the wp-content/uploads directory. All versions up to and including 1.4.125 are affected (CVE-2026-104746, CVSS 8.1). Update to the latest version, or deactivate and remove the plugin if no update is available.

WPJAM Basic (4,000 active installations)

A flaw in the signup function lets unauthenticated attackers create a new user with a role of their choice, including Administrator. Exploitation requires a registered social-login provider and open registration. Versions up to and including 7.1 are affected (CVE-2026-103900, CVSS 8.1). Update to the latest version, or deactivate and remove the plugin if no update is available.

Affiliate Program Suite – SliceWP Affiliates (10,000 active installations)

Unauthenticated attackers can perform SQL injection via the 'email' parameter and extract sensitive information from the database; the vulnerable code runs on WooCommerce My Account registration. All versions up to and including 1.2.14 are affected (CVE-2026-120043, CVSS 7.5). Update to the latest version, or deactivate and remove the plugin if no update is available.

AutomatorWP (6,000 active installations)

Missing role checks in user creation actions can allow unauthenticated attackers to obtain a new administrator account. This requires an anonymous automation whose Role option is bound to a dynamic trigger tag such as {comment_author}, and is triggered when an administrator approves a comment. All versions up to and including 6.0.4 are affected (CVE-2026-104768, CVSS 7.5). Update to the latest version and review any automations that create users or change roles.

Quttera ThreatSign – Web Malware Scanner (10,000 active installations)

Unauthenticated attackers can store malicious scripts via the HTTP User-Agent header, which then run when an administrator opens the affected page. All versions up to and including 4.1.0.48 are affected (CVE-2026-115548, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available.

Link Library (10,000 active installations)

Unauthenticated attackers can store malicious scripts via the 'link_description' parameter, but only if the non-default setting 'Convert [] to <> in Link Description and Notes' is enabled. All versions up to and including 7.10.0 are affected (CVE-2026-116537, CVSS 7.2). Update to the latest version and check whether this setting is needed on your sites.

WS Form LITE – Drag & Drop Contact Form Builder (10,000 active installations)

Unauthenticated attackers can store malicious scripts via form field parameters because a client-side escaping helper passes non-string values through unchanged. All versions up to and including 1.12.18 are affected (CVE-2026-122231, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available.

VikBooking Hotel Booking Engine & PMS (8,000 active installations)

Unauthenticated attackers can store malicious scripts via the guest documents parameter of the pre-check-in form; the required booking token can be obtained by making an ordinary public booking. All versions up to and including 1.8.17 are affected (CVE-2026-93429, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available.

Pie Register – User Registration, Profiles & Content Restriction (1,000 active installations)

Unauthenticated attackers can store malicious scripts via the 'first_name' parameter when public registration is enabled and the form includes a Profile Picture field. All versions up to and including 3.8.4.16 are affected (CVE-2026-119158, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available.

How to check your sites

Open Plugins > Installed Plugins in the WordPress dashboard of each site and look for the plugins listed above, or run wp plugin list with WP-CLI to see installed plugins and their versions. Update affected plugins with the dashboard or wp plugin update <plugin-slug>. For the privilege escalation flaws, also review the user list for administrator accounts you do not recognise.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-103900
• https://nvd.nist.gov/vuln/detail/CVE-2026-104738