File Upload Vulnerability in Hash Form's Drag & Drop Form Builder

CVE-2024-9417

What is CVE-2024-9417?

The Hash Form – Drag & Drop Form Builder plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to perform limited file uploads. This issue arises from a flaw in the file type validation within the 'handleUpload' function. Versions of the plugin up to and including 1.1.9 are impacted, permitting malicious file types to bypass both 'allowedExtensions' and 'unallowed_extensions' arrays. As a result, attackers may upload files that could contain harmful content, including cross-site scripting payloads, posing significant security risks to the affected WordPress sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References