Hash Form EUVD-2026-64787

The victim must be logged into the WordPress site with sufficient privileges to interact with Hash Form at the time of exploitation, as the forged request is executed under the victim's session. The attacker must induce the authenticated user to load or visit an attacker-controlled page containing the malicious request - passive network access alone is insufficient. Hash Form plugin version 1.4.0 or earlier must be installed and active on the target WordPress instance. Exploitation is limited by the UI:R (user interaction required) constraint: automated, unsolicited mass exploitation against default configurations without social engineering is not feasible. No non-default configuration is required beyond having the plugin active.

The CVSS base score of 4.3 (Medium) accurately reflects the constrained real-world impact: exploitation requires a logged-in WordPress user to visit an attacker-controlled page (UI:R), limiting opportunistic mass exploitation. The integrity impact is rated Low (I:L) with no confidentiality or availability impact, meaning the worst realistic outcome is unauthorized form manipulation or configuration changes scoped to the plugin. No KEV listing and no public exploit code are identified at time of analysis, and the EPSS data is absent from the provided sources - without an EPSS score, exploitation probability cannot be quantified. Even a small-to-mid-sized WordPress site operator should treat this as a routine patching priority rather than an emergency response item. The Patchstack disclosure and ENISA EUVD-2026-64787 registration confirm this is a documented, vendor-acknowledged finding rather than speculation.

An attacker crafts a malicious web page containing an auto-submitting HTML form that targets a vulnerable Hash Form endpoint. When an authenticated WordPress administrator visits the page - for example, via a phishing link - their browser silently forwards the forged request with their session credentials, causing the plugin to execute the action (such as modifying form settings or data) without the user's knowledge. No public exploit code has been identified at time of analysis, so this scenario currently requires manual crafting by the attacker.