CVE-2026-78280
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.
Risk Assessment
Risk of unauthorized changes to form configuration or data, potentially leading to integrity compromise of the site.
Recommendation
Update the Hash Form plugin to the latest version that includes the fix.
Other vulnerabilities in Hash Form
See all- CVE-2026-81780Critical
An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.
- CVE-2026-78292Critical
The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS