CVE-2024-5084: 
WordPress vulnerability analysis and mitigation

The Hash Form – Drag & Drop Form Builder plugin for WordPress contains a critical vulnerability (CVE-2024-5084) discovered in May 2024. The vulnerability affects all versions up to and including 1.1.0, where missing file type validation in the 'file_upload_action' function allows unauthenticated attackers to upload arbitrary files to the affected site's server (Wordfence Advisory).

The vulnerability stems from insufficient file type validation in the 'file_upload_action' function, which can be found in the HashFormBuilder.php file. The CVSS v3.1 base score is 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating the highest severity level. The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type (NVD Database).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected WordPress site's server, potentially leading to remote code execution. This level of access could give attackers complete control over the affected website (NVD Database).

The vulnerability is particularly severe as it requires no authentication and can be exploited remotely with low attack complexity. Active exploitation attempts have been observed in the wild, as indicated by security monitoring services (GreyNoise Report).

A patch has been released to address this vulnerability. Site administrators should immediately upgrade to version 1.1.1 or later of the Hash Form plugin (WordPress Patch).