CVE-2024-5085 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection

What is CVE-2024-5085?

CVE-2024-5085 is a high-severity unsafe deserialization vulnerability in hashthemes Hash Form – Drag & Drop Form Builder, published on 23 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Weakness: CWE-502

Which versions are affected by CVE-2024-5085?

It affects 1 product.

Products include Hashthemes Hash Form.

How do I fix CVE-2024-5085?

No fix has been published for CVE-2024-5085 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2024-5085 being exploited?

There is no known exploitation of CVE-2024-5085 in the wild and no public exploit code.

Other vulnerabilities in hashthemes Hash Form – Drag & Drop Form Builder

• CVE-2024-5084 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution Critical 9.8
• CVE-2024-9417 Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload Medium 6.1
• CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8r4g-xwxx-qhqq.