CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation
Authenticated contributors can create form styles without proper authorization due to missing capability checks in the Hash Form plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12201?
CVE-2024-12201 is a medium-severity missing authorization vulnerability in hashthemes Hash Form – Drag & Drop Form Builder, published on 12 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
Weakness: CWE-862
Which versions are affected by CVE-2024-12201?
It affects 1 product.
Products include Hashthemes Hash Form.
How do I fix CVE-2024-12201?
No fix has been published for CVE-2024-12201 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-12201 being exploited?
There is no known exploitation of CVE-2024-12201 in the wild and no public exploit code.
Other vulnerabilities in hashthemes Hash Form – Drag & Drop Form Builder
- CVE-2024-5084 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
- CVE-2024-5085 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection
- CVE-2024-9417 Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
Sources
Also known as GHSA-pfgx-5cqm-92jc.