CVE-2026-78292
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Risk Assessment
Risk of taking over the WordPress site or executing malicious code on the server without authentication.
Recommendation
Update the Hash Form plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Hash Form
See all- CVE-2026-78280Medium
Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.
- CVE-2026-81780Critical
An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS