CVE-2024-5084: Hash Form WordPress Plugin RCE Vulnerability

CVE-2024-5084 Overview

The Hash Form – Drag & Drop Form Builder plugin for WordPress contains a critical arbitrary file upload vulnerability due to missing file type validation in the file_upload_action function. This vulnerability affects all versions up to and including 1.1.0, allowing unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Critical Impact

Unauthenticated attackers can upload malicious files such as web shells to WordPress servers, enabling complete site takeover and remote code execution without any authentication.

Affected Products

• hashthemes hash_form versions up to and including 1.1.0
• WordPress installations using the vulnerable Hash Form plugin
• Sites utilizing the Drag & Drop Form Builder functionality with file upload features

Discovery Timeline

• 2024-05-23 - CVE-2024-5084 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-5084

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in the file_upload_action function within the Hash Form plugin, which fails to properly validate the type of files being uploaded through form submissions. The lack of file type validation creates a direct path for attackers to upload executable files, including PHP web shells, to the WordPress uploads directory.

The vulnerability is particularly dangerous because it requires no authentication. Any remote attacker can craft a malicious request to the vulnerable endpoint and upload arbitrary files. Once a malicious PHP file is uploaded, the attacker can execute it by directly accessing the uploaded file's URL, achieving full remote code execution on the target server.

Root Cause

The root cause of this vulnerability is the absence of file type validation in the file_upload_action function located in HashFormBuilder.php. The function processes file uploads without checking file extensions, MIME types, or content signatures. This allows any file type, including executable scripts like .php, .phtml, or other server-side code files, to be uploaded and stored on the server.

Proper file upload security requires implementing multiple layers of validation including extension whitelisting, MIME type verification, and content inspection. The vulnerable code bypasses all these security controls, accepting whatever file the user submits.

Attack Vector

The attack is executed remotely over the network without requiring any authentication or user interaction. An attacker can target any WordPress site running the vulnerable Hash Form plugin by:

1. Identifying the vulnerable endpoint associated with file uploads
2. Crafting a malicious HTTP request containing a PHP web shell or other malicious file
3. Submitting the file through the file_upload_action function
4. Accessing the uploaded file directly via the WordPress uploads URL to execute arbitrary code

The vulnerability in the file_upload_action function within HashFormBuilder.php allows attackers to bypass file type restrictions entirely. Without proper validation, malicious files such as PHP web shells can be uploaded directly to the server. Once uploaded, these files can be executed by accessing them through the WordPress uploads directory, granting the attacker full control over the web server. For technical details, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2024-5084

Indicators of Compromise

• Unexpected PHP files or web shells in the WordPress uploads directory (typically wp-content/uploads/)
• Suspicious HTTP POST requests to Hash Form file upload endpoints containing executable file extensions
• Unusual process spawning from the web server (Apache/Nginx) indicating web shell activity
• Modified or newly created files in plugin directories with recent timestamps
• Anomalous outbound network connections from the web server

Detection Strategies

• Monitor web server access logs for POST requests to Hash Form upload handlers with suspicious file extensions (.php, .phtml, .phar)
• Implement file integrity monitoring on the WordPress uploads directory to detect new executable files
• Deploy web application firewall (WAF) rules to block upload requests containing dangerous file types
• Enable WordPress security plugins that scan for malicious file uploads and web shells

Monitoring Recommendations

• Configure real-time alerting for any PHP file creation in upload directories
• Implement log correlation to identify attack patterns targeting form upload functionality
• Monitor for indicators of web shell activity such as unusual command execution or file access patterns
• Review web server error logs for failed code execution attempts that may indicate reconnaissance

How to Mitigate CVE-2024-5084

Immediate Actions Required

• Update the Hash Form plugin to version 1.1.1 or later immediately
• Audit the WordPress uploads directory for any suspicious or unexpected PHP files
• Review web server logs for evidence of exploitation attempts
• Consider temporarily disabling the Hash Form plugin until patched if an immediate update is not possible
• Implement file type restrictions at the web server level as an additional defense layer

Patch Information

HashThemes has released a security patch addressing this vulnerability. The fix implements proper file type validation in the file_upload_action function to prevent arbitrary file uploads. Administrators should update to the patched version through the WordPress plugin repository. The patch details can be reviewed in the WordPress Changeset Log.

Workarounds

• Disable the file upload functionality in Hash Form until the plugin can be updated
• Implement server-level file upload restrictions using .htaccess rules to prevent PHP execution in upload directories
• Deploy a Web Application Firewall (WAF) with rules to block malicious file upload attempts
• Restrict file upload permissions at the operating system level for the web server user

# Prevent PHP execution in WordPress uploads directory
# Add to .htaccess in wp-content/uploads/
<FilesMatch "\.(?:php|phtml|php[0-9]+|phar)$">
    Require all denied
</FilesMatch>

# Alternative Apache configuration
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
</Directory>