CVE-2024-9417CWE-434

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

Medium · published October 5, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-10-05T09:39Z
EPSS history
Timeline
  • 05 OCT 09:39Z
    Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
    cvelistv5