Rapid7

module

WordPress Hash Form Plugin RCE

Try Surface Command
Back to search
Disclosed
May 23, 2024
Created
Jun 5, 2024

Description

The Hash Form - Drag & Drop Form Builder plugin for WordPress suffers from a critical vulnerability
due to missing file type validation in the file_upload_action function. This vulnerability exists
in all versions up to and including 1.1.0. Unauthenticated attackers can exploit this flaw to upload arbitrary
files, including PHP scripts, to the server, potentially allowing for remote code execution on the affected
WordPress site. This module targets multiple platforms by adapting payload delivery and execution based on the
server environment.

Authors

Francesco Carlucci
Valentin Lobstein

Platform

Linux,PHP,Unix,Windows

Architectures

php, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/wp_hash_form_rce
    msf exploit(wp_hash_form_rce) > show targets
        ...targets...
    msf exploit(wp_hash_form_rce) > set TARGET < target-id >
    msf exploit(wp_hash_form_rce) > show options
        ...show and set options...
    msf exploit(wp_hash_form_rce) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report