Medium severity6.1NVD Advisory· Published Oct 5, 2024· Updated Jun 17, 2026
CVE-2024-9417
CVE-2024-9417
Description
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- hashthemes/Hash Form – Drag & Drop Form Builderv5Range: 0
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changeset/3161828/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/cad7731a-1f81-4055-9b49-15b35edd3fcfnvdThird Party Advisory
- plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.phpnvdProduct
- plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.phpnvdProduct
News mentions
0No linked articles in our index yet.