CVE-2024-5084: Hash Form WordPress Plugin RCE Vulnerability

CVE-2024-5084 Overview

The Hash Form – Drag & Drop Form Builder plugin for WordPress contains a critical arbitrary file upload vulnerability due to missing file type validation in the file_upload_action function. This vulnerability affects all versions up to and including 1.1.0, allowing unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Critical Impact
Unauthenticated attackers can upload malicious files such as web shells to WordPress servers, enabling complete site takeover and remote code execution without any authentication.

Affected Products

hashthemes hash_form versions up to and including 1.1.0
WordPress installations using the vulnerable Hash Form plugin
Sites utilizing the Drag & Drop Form Builder functionality with file upload features

Discovery Timeline

2024-05-23 - CVE-2024-5084 published to NVD
2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-5084

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in the file_upload_action function within the Hash Form plugin, which fails to properly validate the type of files being uploaded through form submissions. The lack of file type validation creates a direct path for attackers to upload executable files, including PHP web shells, to the WordPress uploads directory.

The vulnerability is particularly dangerous because it requires no authentication. Any remote attacker can craft a malicious request to the vulnerable endpoint and upload arbitrary files. Once a malicious PHP file is uploaded, the attacker can execute it by directly accessing the uploaded file's URL, achieving full remote code execution on the target server.

Root Cause

The root cause of this vulnerability is the absence of file type validation in the file_upload_action function located in HashFormBuilder.php. The function processes file uploads without checking file extensions, MIME types, or content signatures. This allows any file type, including executable scripts like .php, .phtml, or other server-side code files, to be uploaded and stored on the server.

Proper file upload security requires implementing multiple layers of validation including extension whitelisting, MIME type verification, and content inspection. The vulnerable code bypasses all these security controls, accepting whatever file the user submits.

Attack Vector

The attack is executed remotely over the network without requiring any authentication or user interaction. An attacker can target any WordPress site running the vulnerable Hash Form plugin by:

Identifying the vulnerable endpoint associated with file uploads
Crafting a malicious HTTP request containing a PHP web shell or other malicious file
Submitting the file through the file_upload_action function
Accessing the uploaded file directly via the WordPress uploads URL to execute arbitrary code

The vulnerability in the file_upload_action function within HashFormBuilder.php allows attackers to bypass file type restrictions entirely. Without proper validation, malicious files such as PHP web shells can be uploaded directly to the server. Once uploaded, these files can be executed by accessing them through the WordPress uploads directory, granting the attacker full control over the web server. For technical details, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2024-5084

Indicators of Compromise

Unexpected PHP files or web shells in the WordPress uploads directory (typically wp-content/uploads/)
Suspicious HTTP POST requests to Hash Form file upload endpoints containing executable file extensions
Unusual process spawning from the web server (Apache/Nginx) indicating web shell activity
Modified or newly created files in plugin directories with recent timestamps
Anomalous outbound network connections from the web server

Detection Strategies

Monitor web server access logs for POST requests to Hash Form upload handlers with suspicious file extensions (.php, .phtml, .phar)
Implement file integrity monitoring on the WordPress uploads directory to detect new executable files
Deploy web application firewall (WAF) rules to block upload requests containing dangerous file types
Enable WordPress security plugins that scan for malicious file uploads and web shells

Monitoring Recommendations

Configure real-time alerting for any PHP file creation in upload directories
Implement log correlation to identify attack patterns targeting form upload functionality
Monitor for indicators of web shell activity such as unusual command execution or file access patterns
Review web server error logs for failed code execution attempts that may indicate reconnaissance

How to Mitigate CVE-2024-5084

Immediate Actions Required

Update the Hash Form plugin to version 1.1.1 or later immediately
Audit the WordPress uploads directory for any suspicious or unexpected PHP files
Review web server logs for evidence of exploitation attempts
Consider temporarily disabling the Hash Form plugin until patched if an immediate update is not possible
Implement file type restrictions at the web server level as an additional defense layer

Patch Information

HashThemes has released a security patch addressing this vulnerability. The fix implements proper file type validation in the file_upload_action function to prevent arbitrary file uploads. Administrators should update to the patched version through the WordPress plugin repository. The patch details can be reviewed in the WordPress Changeset Log.

Workarounds

Disable the file upload functionality in Hash Form until the plugin can be updated
Implement server-level file upload restrictions using .htaccess rules to prevent PHP execution in upload directories
Deploy a Web Application Firewall (WAF) with rules to block malicious file upload attempts
Restrict file upload permissions at the operating system level for the web server user

bash

# Prevent PHP execution in WordPress uploads directory
# Add to .htaccess in wp-content/uploads/
<FilesMatch "\.(?:php|phtml|php[0-9]+|phar)$">
    Require all denied
</FilesMatch>

# Alternative Apache configuration
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
</Directory>