CVE-2024-9417: Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowedextensions' arrays on the affected site's server, including files that may contain cross-site scripting.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9417?
CVE-2024-9417 is considered a high severity vulnerability due to the potential for unauthenticated file uploads.
How do I fix CVE-2024-9417?
To fix CVE-2024-9417, update the Hash Form Drag & Drop Form Builder plugin to version 1.1.10 or later.
What versions of the Hash Form Drag & Drop Form Builder plugin are affected by CVE-2024-9417?
CVE-2024-9417 affects all versions up to and including 1.1.9 of the Hash Form Drag & Drop Form Builder plugin.
Who can exploit CVE-2024-9417?
CVE-2024-9417 can be exploited by unauthenticated attackers due to improper file type validation.
What types of attacks can CVE-2024-9417 enable?
CVE-2024-9417 can enable attackers to upload arbitrary files, potentially leading to remote code execution.