CVE-2026-81780

Hash Form, a WordPress form-builder plugin, versions up to and including 1.4.2 contain an unauthenticated arbitrary file upload flaw (CWE-434) that lets any unauthenticated remote visitor upload files of unrestricted type. An attacker triggers it by sending a crafted upload request to the plugin's upload functionality without logging in or interacting with an admin; because dangerous file types such as PHP are accepted, uploaded files can land in web-accessible upload directories. If the uploaded PHP file is executed by the web server, the attacker achieves remote code execution and full site compromise, consistent with the CVSS 10.0 critical score and changed scope. All WordPress sites running Hash Form 1.4.2 or earlier are affected. There is no confirmed in-the-wild exploitation yet, but a public proof-of-concept exists (EPSS 0.3%, not in CISA KEV), so patching is urgent despite currently low observed exploit probability.

What to do: Update Hash Form to the latest release (any version above 1.4.2) immediately. If you cannot patch right away, block unauthenticated file-upload requests to the plugin's endpoints via a WAF rule and review WordPress upload directories for unexpected .php or other executable files, which would indicate prior compromise. Given the public PoC, assume opportunistic scanning may begin soon.