CVE-2024-5085: Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'processentry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5085?
CVE-2024-5085 has been classified as a critical severity vulnerability due to its potential for remote code execution via PHP Object Injection.
How do I fix CVE-2024-5085?
To mitigate CVE-2024-5085, you should update the Hash Form – Drag & Drop Form Builder plugin to the latest version beyond 1.1.0.
Who is affected by CVE-2024-5085?
All users of the Hash Form – Drag & Drop Form Builder plugin for WordPress, specifically versions up to and including 1.1.0, are affected by CVE-2024-5085.
Can CVE-2024-5085 be exploited by authenticated users?
No, CVE-2024-5085 can be exploited by unauthenticated attackers, making it more critical as it requires no prior authorization.
What component of the plugin is vulnerable in CVE-2024-5085?
The 'process_entry' function in the Hash Form – Drag & Drop Form Builder plugin is vulnerable to PHP Object Injection in CVE-2024-5085.