CVE-2024-5085

CVE-2024-5085 is a critical PHP Object Injection vulnerability affecting all versions of the Hash Form – Drag & Drop Form Builder plugin for WordPress up to and including 1.1.0. This flaw allows unauthenticated attackers to inject PHP Objects through untrusted input deserialization in the 'process_entry' function. With a CVSS score of 9.8 (Critical), this vulnerability has a low attack complexity and could lead to complete compromise of confidentiality, integrity, and availability if a suitable POP chain exists on the target system. While no known POP chain is present in the vulnerable software itself, an attacker could potentially delete files, retrieve sensitive data, or execute code if a POP chain is introduced by another plugin or theme. Currently, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this CVE.