File Upload Vulnerability in Hash Form's Drag & Drop Form Builder

CVE-2024-9417
6.1MEDIUM

Key Information

Vendor
Hashthemes
Status
Hash Form – Drag & Drop Form Builder
Vendor
CVE Published:
5 October 2024

Summary

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.

Affected Version(s)

Hash Form – Drag & Drop Form Builder <= 1.1.9

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published.

  • Disclosed

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Rein Daelman
.