The vulnerability is an unauthenticated Cross Site Request Forgery flaw that exists in WordPress Hash Form plugin versions up to and including 1.4.0. It allows an attacker who can trick a legitimate user into visiting a crafted URL or submitting a malicious form to perform actions within the victim’s account without their knowledge. The impact is primarily on the integrity of data, as the attacker can create or modify form entries and thus alter or compromise site content. This flaw is designated as CWE-352, indicating a lack of proper anti‑CSRF token validation.

The affected product is the Hash Form plugin developed by HashThemes. All installations of HashForm plugin with a version of 1.4.0 or earlier are vulnerable. No further vendor or product variants are listed in the advisory.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score is not available and the vulnerability is not documented in the CISA KEV catalog. The attack vector is inferred to be remote via the public web interface: an attacker can submit a crafted request that a victim’s browser would automatically forward with their credentials. The absence of a per‑user state or secret token makes exploitation straightforward for a well‑targeted user, though the overall probability of exploitation remains unclear due to missing EPSS data.