# CVE-2026-78280: HashThemes Hash Form cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-78280-hashthemes-hash-form-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78280 · Severity: medium · CVSS 4.3 · Published 2026-08-24

Hash Form is a WordPress form-building plugin used by site administrators to create and manage web forms. An unauthenticated attacker can trick a logged-in admin into performing unintended actions—such as modifying form settings or configurations—by crafting a malicious webpage, without the user's knowledge or consent. This could lead to unauthorized changes to critical site functionality.

Technologies: [HashThemes Hash Form](https://junglewise.ai/threats/technologies/hash-form). Vendors: [HashThemes](https://junglewise.ai/threats/vendors/hashthemes).

## Quick answers

**Is CVE-2026-78280 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78280 being exploited in the wild.

**How severe is CVE-2026-78280?** Medium severity, with a CVSS score of 4.3, published 24 August 2026.

**Which products and versions are affected?** HashThemes Hash Form <= 1.4.0.

**Is there a fix for CVE-2026-78280?** A patch was published on 2026-08-24: Fixed in version 1.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78280 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78280?** Check whether you run HashThemes Hash Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Hash Form plugin versions 1.4.0 and earlier. The plugin fails to properly validate or protect against cross-site requests, allowing an attacker to forge requests that execute actions on behalf of authenticated administrators. Attack requires user interaction: a logged-in admin must be tricked into visiting an attacker-controlled page. An attacker can modify form configurations, settings, or other admin-level functionality without the user's consent. The vulnerability is patched in version 1.4.1 and later.

## Affected products

- HashThemes Hash Form <= 1.4.0

## Timeline

- 2026-08-24: disclosed: Published by Patchstack
- 2026-08-24: patched: Fixed in version 1.4.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/hash-form/vulnerability/wordpress-hash-form-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/hash-form/vulnerability/wordpress-hash-form-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)

## Related threats

- [Hash Form arbitrary file upload](https://junglewise.ai/threats/cve-2026-81780-hash-form-arbitrary-file-upload)
- [Hash Form PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-78292-hash-form-php-object-injection-vulnerability)