Executive brief
Hash Form is a WordPress plugin used to create and manage forms on websites. An unauthenticated attacker can exploit a PHP object injection vulnerability to execute arbitrary code on the server, potentially compromising the entire website, stealing customer data, and deploying malware without requiring any login credentials.
Technical details
This vulnerability is a PHP object injection flaw in Hash Form versions 1.4.1 and earlier. The plugin fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious serialized PHP objects. By leveraging existing PHP gadget chains in WordPress or its dependencies, an attacker can achieve remote code execution on the web server. The vulnerability requires only network access and no authentication, making it trivial to exploit at scale. A fix is available in version 1.4.2 and later.
Affected products
- HashThemes Hash Form 1.4.1 and earlier
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory