CVE-2026-81780: Hash Form Arbitrary File Upload Vulnerability

CVE-2026-81780 Overview

CVE-2026-81780 is an unauthenticated arbitrary file upload vulnerability affecting the Hash Form WordPress plugin in versions up to and including 1.4.2. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Attackers can upload arbitrary files to affected WordPress sites without any authentication. Successful exploitation allows attackers to place executable PHP payloads on the server, leading to remote code execution. The vulnerability carries a maximum CVSS score of 10.0 and requires no user interaction.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files, including web shells, resulting in full compromise of the WordPress host.

Affected Products

WordPress Hash Form plugin versions <= 1.4.2
WordPress sites with the Hash Form plugin installed and activated
Any hosting environment executing PHP files uploaded to WordPress upload directories

Discovery Timeline

2026-08-31 - CVE-2026-81780 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81780

Vulnerability Analysis

The Hash Form plugin exposes a file upload handler that does not validate uploader identity or file type. The plugin accepts file uploads through form submission endpoints intended for legitimate form attachments. Because authentication is not enforced and file extensions or MIME types are not restricted to safe values, attackers can submit crafted requests containing PHP scripts. The uploaded files land in a web-accessible directory, where the web server executes them on request. The scope change in the CVSS vector indicates that a compromise of the plugin can extend impact beyond the plugin's own security boundary to the entire WordPress installation and underlying host.

Root Cause

The root cause is missing or insufficient server-side validation of uploaded files in the Hash Form submission handler. The handler fails to enforce two controls: an authentication or capability check on the uploader, and an allowlist of safe file extensions and MIME types. This combination maps directly to CWE-434, unrestricted upload of file with dangerous type.

Attack Vector

Exploitation occurs over the network against the WordPress site's public form submission endpoint. An attacker crafts an HTTP POST request containing a PHP file disguised as, or submitted alongside, a form attachment. After upload, the attacker requests the file's URL directly. The web server executes the PHP payload under the WordPress process account, giving the attacker code execution, database access, and typically the ability to pivot into other tenants on shared hosts. For technical details, refer to the Patchstack Security Advisory.

Detection Methods for CVE-2026-81780

Indicators of Compromise

Presence of unexpected .php, .phtml, or .phar files in wp-content/uploads/ directories associated with Hash Form submissions.
Web server access logs showing POST requests to Hash Form submission endpoints followed by GET requests to newly created files in upload paths.
Outbound network connections from the PHP worker process to unknown external hosts shortly after form submission activity.
New administrative WordPress users, modified wp-config.php, or unexpected cron entries created after suspicious upload events.

Detection Strategies

Inspect WordPress upload directories for files with executable server-side extensions and file signatures containing PHP tags.
Correlate HTTP POST requests to Hash Form endpoints with subsequent requests to files under /wp-content/uploads/ for the same client IP.
Alert on file integrity monitoring events that record creation of PHP files under directories that should only contain media assets.

Monitoring Recommendations

Enable web application firewall logging for all requests targeting Hash Form endpoints and retain full request bodies for forensic review.
Forward WordPress, PHP-FPM, and web server logs into a centralized analytics platform to enable cross-source correlation.
Monitor process execution on the web server for PHP interpreter child processes spawning shells, curl, wget, or system reconnaissance commands.

How to Mitigate CVE-2026-81780

Immediate Actions Required

Deactivate and remove the Hash Form plugin on all affected WordPress sites until a patched release is confirmed installed.
Audit the wp-content/uploads/ directory tree for unauthorized PHP files and remove any identified web shells.
Rotate all WordPress administrator passwords, API keys, and database credentials that may have been exposed to a compromised host.
Review WordPress user accounts for unauthorized additions and reissue session tokens by forcing global logout.

Patch Information

Refer to the Patchstack Security Advisory for the fixed version and vendor guidance. Upgrade Hash Form to a version later than 1.4.2 as soon as the vendor releases a corrected build. Confirm the plugin update via the WordPress admin dashboard and verify the version string after installation.

Workarounds

Block requests to Hash Form submission endpoints at the web application firewall until a patch is applied.
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directory-scoped handler restrictions.
Enforce an allowlist of file extensions such as .jpg, .png, and .pdf at the reverse proxy or WAF layer for upload endpoints.

bash

# Apache: prevent PHP execution inside WordPress uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block in the site server config
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php5|php7|pht)$ {
    deny all;
    return 403;
}