File Upload Vulnerability in Hash Form's Drag & Drop Form Builder

CVE-2024-9417

What is CVE-2024-9417?

The Hash Form – Drag & Drop Form Builder plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to perform limited file uploads. This issue arises from a flaw in the file type validation within the 'handleUpload' function. Versions of the plugin up to and including 1.1.9 are impacted, permitting malicious file types to bypass both 'allowedExtensions' and 'unallowed_extensions' arrays. As a result, attackers may upload files that could contain harmful content, including cross-site scripting payloads, posing significant security risks to the affected WordPress sites.

References