Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WordPress Hash Form plugin up to 1.4.1 can let attackers run code

CVE-2026-78292 · published 7 days ago
Summary

The Hash Form add‑on for WordPress, versions 1.4.1 and earlier, can be tricked into executing unwanted commands without any login. This could allow a remote person to take control of your site or steal data. Update the plugin to the latest version or remove it if you do not need it.

What to do
  • Update hashthemes hash form to version 1.4.2.
Affected software
VendorProductAffected versions
hashthemes hash form <= 1.4.1
Fix: upgrade to 1.4.2
Original advisory text
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published27 Aug 2026
Updated3 Sep 2026
First seen27 Aug 2026
Sources
CVE-2026-78292 · NVD
CVE-2026-78292 · MITRE
Monitor software like this
Free during beta