Unrestricted file uploads are possible in all versions of the WordPress Hash Form plugin up to and including 1.4.2. The plugin accepts file uploads through a public form that does not verify the identity or role of the requester. An attacker can place any file, including malicious scripts, onto the server. If the uploaded file is executable by the web server, the attacker can run code with the permissions of the web application, effectively achieving full control of the affected site.

WordPress installations that have the Hash Form plugin by hashthemes installed and running a version older than 1.4.3 are affected. The vulnerability exists across all releases up to version 1.4.2, regardless of the WordPress core version.

With a CVSS score of 10 the flaw is considered critically severe. No EPSS data is available, so the probability of exploitation is unknown but the lack of authentication makes the attack easy for adversaries. The vulnerability is not currently listed in CISA’s KEV database. The likely attack path involves sending an unauthenticated HTTP request to the plugin’s upload endpoint, placing a malicious file, and then executing it through a web request or by exploiting other weaknesses on the server. A successful exploit would give the attacker arbitrary code execution and could lead to full site compromise.