CVE-2026-78292 CRITICAL

CVE-2026-78292: WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

Vendor Hashthemes
Product Hash Form
Weakness CWE-502 · Unsafe deserialization
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Hash Form versions up to 1.4.1 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on the site. The vulnerability exists because the product deserializes untrusted data without proper validation. An attacker can exploit this remotely over the network without requiring authentication or user interaction.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site and take complete control of it.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can steal data, modify content, install malware, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 27, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-65577 WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import CVE-2026-57744 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability