CVE-2024-9417: Hash Form WordPress Plugin XSS Vulnerability

CVE-2024-9417 Overview

The Hash Form – Drag & Drop Form Builder plugin for WordPress contains an unrestricted file upload vulnerability in the handleUpload function. The flaw affects all versions up to and including 1.1.9. Unauthenticated attackers can upload files whose extensions are missing from both the allowedExtensions and unallowed_extensions arrays. Uploaded files may contain cross-site scripting (XSS) payloads that execute in the context of visitors or administrators. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated attackers can upload arbitrary files containing XSS payloads to affected WordPress sites, enabling stored cross-site scripting against users who load the uploaded content.

Affected Products

Hashthemes Hash Form – Drag & Drop Form Builder plugin for WordPress
All versions up to and including 1.1.9
WordPress sites running the vulnerable plugin with public form endpoints

Discovery Timeline

2024-10-05 - CVE-2024-9417 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9417

Vulnerability Analysis

The vulnerability resides in the handleUpload function of the HashFormUploader.php class. The function validates uploaded file extensions against two arrays: allowedExtensions and unallowed_extensions. Any file extension absent from both lists bypasses validation entirely. This deny-list and allow-list gap creates a class of file types the plugin neither explicitly permits nor blocks, yet still writes to disk.

Attackers can abuse this gap to upload files that browsers interpret as HTML or script, such as .svg or other non-listed extensions carrying JavaScript. When a user retrieves the uploaded file, the payload executes in the browser under the site origin. This yields stored cross-site scripting without any authentication requirement, though user interaction is needed to trigger the payload. Refer to the Wordfence vulnerability analysis for additional context.

Root Cause

The root cause is inconsistent file type validation logic. The handleUpload function uses both an allow list and a deny list without a default-deny fallback. Extensions absent from both arrays pass validation. The vulnerable code paths demonstrate this gap in the upstream source before the patch.

Attack Vector

An unauthenticated attacker submits a crafted file upload to a public Hash Form endpoint on the target site. The attacker selects an extension that neither array covers but that a browser will render as active content. After the server stores the file, the attacker distributes a link to the uploaded resource. When a victim loads the URL, the payload runs in the site's origin and can steal session cookies, perform actions on behalf of the user, or deface content.

No verified proof-of-concept code is publicly available. Detailed technical references are published on the WordPress plugin trac source browser.

Detection Methods for CVE-2024-9417

Indicators of Compromise

Unexpected files in the Hash Form uploads directory with extensions such as .svg, .html, .htm, or other non-standard types
Web server access log entries showing POST requests to Hash Form upload endpoints from unauthenticated sources
Outbound requests from user browsers to attacker-controlled domains following retrieval of an uploaded file

Detection Strategies

Inventory WordPress installations and identify sites running Hash Form plugin versions 1.1.9 or earlier
Scan the plugin uploads directory for files whose extensions fall outside the intended allow list
Inspect uploaded file contents for <script> tags, JavaScript event handlers, or SVG elements containing executable content
Monitor WordPress audit logs for anomalous form submission volume against Hash Form endpoints

Monitoring Recommendations

Enable web application firewall (WAF) rules that inspect multipart upload payloads for script content
Log every file upload event with source IP, filename, extension, and content hash for retrospective analysis
Alert on repeated unauthenticated requests to admin-ajax.php or REST routes registered by Hash Form

How to Mitigate CVE-2024-9417

Immediate Actions Required

Update the Hash Form plugin to a version later than 1.1.9 that includes the fix from WordPress changeset #3161828
If patching is not immediately possible, disable the Hash Form plugin on affected sites
Audit the plugin uploads directory and remove any files uploaded by unauthenticated users during the exposure window
Rotate session cookies and administrator credentials if suspicious uploads are found

Patch Information

The vendor addressed the vulnerability in the commit published as WordPress changeset #3161828. The fix enforces stricter file type validation within the handleUpload function so that extensions absent from the allow list are rejected by default. Site administrators should upgrade to the fixed release through the WordPress plugin manager.

Workarounds

Configure the web server to deny direct execution and inline rendering of files served from the Hash Form uploads directory
Set Content-Disposition: attachment and a restrictive Content-Security-Policy header on responses from the uploads path
Restrict access to Hash Form upload endpoints using WAF rules or IP allow listing until the patch is applied
Remove public forms that permit file attachments until the plugin is updated

bash

# Example Apache configuration to force download of files in the Hash Form uploads directory
<Directory "/var/www/html/wp-content/uploads/hashform">
    Header set Content-Disposition "attachment"
    Header set Content-Security-Policy "default-src 'none'; sandbox"
    php_flag engine off
</Directory>