PHP Object Injection Vulnerability in Hash Form - Drag & Drop Form Builder Plugin for WordPress

CVE-2024-5085

Summary

The Hash Form – Drag & Drop Form Builder plugin for WordPress contains a vulnerability that allows for PHP Object Injection due to the deserialization of untrusted input in the 'process_entry' function. This issue affects all versions up to and including 1.1.0. If exploited, unauthorized attackers can inject malicious PHP objects, potentially leading to severe consequences such as file deletion, data leakage, or remote code execution if a suitable PHP Object Injection (POP) chain is available from other plugins or themes present on the affected system.

References