A critical PHP object injection vulnerability in the Hash Form WordPress plugin allows unauthenticated attackers to achieve remote code execution and full system compromise.

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data, occurring when the plugin improperly deserializes user-supplied input. Because the entry point is accessible without authentication, an attacker can supply malicious serialized objects to trigger arbitrary code execution on the underlying server.

The CVSS score of 9.8 reflects the high severity of this flaw, as it permits full compromise of the web application without requiring valid credentials. Successful exploitation could lead to total data exfiltration, unauthorized administrative access, and the potential for lateral movement within the hosting environment, posing a severe risk to organizational data integrity and availability.

Immediate Action: Update the Hash Form plugin to version 1.4.2 or the latest available version immediately.

Proactive Monitoring: Review web server access logs for suspicious serialized string patterns or anomalous POST requests directed at the plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts targeting WordPress plugin parameters.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the lack of authentication required for exploitation, administrators should treat this as an emergency patch requirement. Please audit all WordPress instances running the Hash Form plugin and apply the update to version 1.4.2 without delay to prevent potential compromise.