The Hash Form plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability that poses a critical risk of full remote code execution.

This vulnerability is classified as an unrestricted upload of a file with a dangerous type (CWE-434). It allows an unauthenticated attacker to upload arbitrary files to the server, which can be executed to achieve complete system control.

The ability for an unauthenticated attacker to upload files to a web server is a critical security failure, as it typically leads to the execution of malicious scripts or shells. This vulnerability allows for full remote code execution, which can result in complete data exfiltration, unauthorized administrative access to the WordPress environment, and potential lateral movement within the hosting infrastructure, justifying the 10.0 CVSS score.

Immediate Action: Update the Hash Form plugin to version 1.4.3 or the latest available version immediately to close the file upload vector.

Proactive Monitoring: Review web server access logs for requests to unusual file extensions or unexpected uploads to the plugin's directory structure.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads from unauthorized sources or to inspect file types for malicious headers.

Public Exploit Available: Unknown.

Given the critical severity and the potential for total system compromise, administrators must prioritize patching this plugin immediately. If an update cannot be applied instantly, the plugin should be disabled or removed to prevent unauthenticated access to the underlying server file system.