CVE-2026-78292

CriticalCVSS 9.8

Published: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Summary

The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Risk Assessment

Risk of taking over the WordPress site or executing malicious code on the server without authentication.

Recommendation

Update the Hash Form plugin to the latest available version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.