EUVD-2026-68792
GHSA-chvv-mh28-xhg5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote, unauthenticated, no-interaction upload yielding code execution gives full C/I/A; I assess S:U since impact is confined to the WordPress host's security authority, unlike the reporter's S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
AnalysisAI
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a WordPress site has the Hash Form plugin installed and active at version 1.4.2 or earlier with its upload/form-submission endpoint reachable over the network - no authentication, no user interaction, and no special non-default configuration are indicated (PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Hash Form plugin to the vendor's fixed release above 1.4.2; the exact patched version is not specified in the provided data, so verify the current fixed version on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/hash-form/vulnerability/wordpress-hash-form-plugin-1-4-2-arbitrary-file-upload-vulnerability) or the WordPress plugin repository before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable and remove the Hash Form plugin from all WordPress installations; audit web server logs and file system for suspicious uploads with suspicious file types (especially .php, .phtml, .php3+) in the plugin's upload directory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attacke
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up t
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigur
Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated rem
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capa
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today