CVE-2024-5084

🗓️ 23 May 2024 14:31:38Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 194 Views🌐 WEB

The Hash Form plugin for WordPress has arbitrary file upload vulnerabilit

Reporter	Title	Published	Views	Family All 22
0day.today	WordPress Hash Form Plugin Remote Code Execution Exploit	5 Jun 202400:00	–	zdt
GithubExploit	Exploit for Authentication Bypass by Spoofing in Booster Booster_For_Woocommerce	16 Feb 202612:12	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hashthemes Hash_Form	5 Feb 202617:34	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hashthemes Hash_Form	27 May 202420:04	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hashthemes Hash_Form	25 May 202403:49	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hashthemes Hash_Form	30 Nov 202409:15	–	githubexploit
Circl	CVE-2024-5084	5 Jun 202408:42	–	circl
CNNVD	WordPress plugin Hash Form Drag Drop Form Builder 安全漏洞	23 May 202400:00	–	cnnvd
Cvelist	CVE-2024-5084 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution	23 May 202414:31	–	cvelist
Metasploit	WordPress Hash Form Plugin RCE	5 Jun 202419:55	–	metasploit

NVD

Vulners

Vulnrichment

Node

hashthemes hash_formRange<1.1.1wordpress

[
  {
    "vendor": "hashthemes",
    "product": "Hash Form – Drag & Drop Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.1.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/eef9e2fa-d8f0-42bf-95ac-ee4cafff0b14
plugins	www.plugins.trac.wordpress.org/changeset/3090341/
plugins	www.plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormBuilder.php

Parameter	Position	Path	Description	CWE
action	query param	wp-admin/admin-ajax.php	Nonce retrieval endpoint used to obtain a valid nonce for file upload (hashform_preview) can be probed/ abused in vulnerable installations.	CWE-434
form	query param	wp-admin/admin-ajax.php	Nonce retrieval endpoint used to obtain a valid nonce for file upload (hashform_preview) can be probed/ abused in vulnerable installations.	CWE-434
action	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434
file_uploader_nonce	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434
allowedExtensions[0]	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434
sizeLimit	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434
qqfile	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434
data	request body	wp-admin/admin-ajax.php	File upload action (hashform_file_upload_action) accepts arbitrary file uploads due to insufficient validation, enabling attacker-controlled PHP payload delivery.	CWE-434

17 Jun 2026 08:15Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.50934

SSVC

CWE-434