CVE-2024-9417
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Oct 5, 2024
Updated: Feb 27, 2025
CWE ID 434
Summary
CVE-2024-9417 is a vulnerability affecting the Hash Form – Drag & Drop Form Builder plugin for WordPress. The issue stems from a misconfiguration in the 'handleUpload' function, found in all versions up to 1.1.9. This flaw allows unauthenticated attackers to upload files that bypass both the 'allowedExtensions' and 'unallowed_extensions' arrays. The consequence of this vulnerability is the potential execution of cross-site scripting attacks on the affected sites.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.