CVE-2024-9417

MEDIUM

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated File Upload via Misconfigured Extension Validation

Title source: llm

Description

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.

References (4)

Core 4

Core References

Product

https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L107

Product

https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L135

Patch

https://plugins.trac.wordpress.org/changeset/3161828/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/cad7731a-1f81-4055-9b49-15b35edd3fcf?source=cve

Scores

CVSS v3 6.1

EPSS 0.0034

EPSS Percentile 25.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-434

Status published

Products (2)

hashthemes/Hash Form – Drag & Drop Form Builder < 1.1.9

hashthemes/hash_form < 1.2.0

Published Oct 05, 2024

Tracked Since Feb 18, 2026