CVE-2026-78280

MediumCVSS 4.3

Published: 24/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Summary

Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.

Risk Assessment

Risk of unauthorized changes to form configuration or data, potentially leading to integrity compromise of the site.

Recommendation

Update the Hash Form plugin to the latest version that includes the fix.

Other vulnerabilities in Hash Form

CVE-2026-78292Critical
The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Original NVD description (English source)

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.