Security readout for executives and security teams
Plain-English summary
Hash Form for WordPress reportedly allows an unauthenticated internet user to submit data that the plugin may treat as a PHP object. Sites running version 1.4.1 or earlier could face compromise affecting data confidentiality, integrity, and availability. The supplied sources do not confirm exploitation in the wild or identify a fixed version.
Executive priority
Treat confirmed internet-facing installations as an immediate remediation priority because exploitation requires no account or user action and the assessed impact is comprehensive. First establish plugin presence and version, then disable affected deployments or apply a source-confirmed fixed release. Escalate monitoring, but do not report active compromise without supporting evidence.
Technical view
CVE-2026-78292 is an unauthenticated PHP object injection vulnerability classified as CWE-502. It is rated CVSS 3.1 9.8 with network access, low complexity, no privileges, and no user interaction. Practical outcomes may depend on usable PHP classes or gadget chains present in the affected environment.
Likely exposure
Likely exposure is limited to internet-reachable WordPress installations with the Hash Form plugin enabled at version 1.4.1 or earlier. The bundle’s affected-version description conflicts with structured metadata showing “n/a” and a default status of “unaffected,” so administrators should verify applicability against current vendor or Patchstack guidance.
Exploitation context
The vulnerability is described as remotely reachable without authentication or user interaction. The bundle states that it is not in CISA KEV, and no supplied source confirms active exploitation, public exploit availability, or observed attacks. Do not interpret the critical CVSS score alone as evidence of exploitation.
Researcher notes
The record identifies CWE-502 but provides no vulnerable parameter, code path, prerequisite gadget chain, proof of concept, or fixed version. PHP object injection impact can vary with available classes and application context. The inconsistency between the narrative affected range and structured default status warrants confirmation before definitive fleet-wide exposure reporting.
Mitigation direction
- Inventory WordPress sites for Hash Form and record installed versions.
- Disable or remove Hash Form 1.4.1 and earlier where operationally acceptable.
- Check current vendor and Patchstack guidance for a confirmed fixed release.
- Apply the confirmed update promptly when authoritative guidance identifies one.
- Preserve backups and strengthen monitoring while affected installations remain exposed.
Validation and detection
- Confirm whether Hash Form is installed, enabled, and version 1.4.1 or earlier.
- Determine whether affected WordPress endpoints are reachable without authentication.
- Review web, application, and security logs for unusual requests or post-request failures.
- Verify any replacement version against current vendor or Patchstack guidance.
- Retest exposed functionality after remediation and confirm required forms still operate.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-78292 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/hash-form/vulnerability/wordpress-hash-form-plugin-1-4-1-php-object-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.