CVE-2024-5085 is a high severity (CVSS 8.1) PHP object injection flaw in the Hash Form drag and drop form builder plugin for WordPress, versions up to and including 1.1.0. It comes from deserializing untrusted input. Update to a release newer than 1.1.0 from the plugin directory.
What's affected
The record lists the Hash Form plugin by Hashthemes for WordPress, all versions up to and including 1.1.0. The weakness is in the process_entry function and is reachable by unauthenticated visitors, which is why the score sits at 8.1 despite the high attack complexity in the vector (AV:N/AC:H/PR:N/UI:N).
The record does not name a fixed version. It points to a plugin repository changeset (3090341) and a Wordfence entry. Treat any release after 1.1.0 as the target and confirm the exact number in the plugin changelog before you sign off.
How to check if you're exposed
Check the installed version from the server:
wp plugin list --name=hash-form --fields=name,version,status,update
If you manage many sites, run the same command across your fleet with your usual WP-CLI tooling. In the dashboard, look under Plugins for Hash Form and read the version column. Anything at 1.1.0 or lower is in scope, active or not, because inactive plugin files can still sit on disk.
Also list every other plugin and theme on the site. The advisory text stresses that exploitation of the plugin on its own has no known gadget chain, so the real exposure depends on what else is installed.
What to do now
- Update Hash Form to the latest version from the WordPress plugin directory, then confirm the number is above 1.1.0.
- If you cannot update today, deactivate and delete the plugin, then swap the form for another method.
- Update all other plugins and themes, because a gadget chain in any of them is what turns this into file deletion, data theft or code execution.
- Remove plugins and themes you no longer use, which shrinks the pool of available gadget chains.
- Review web server logs for unusual POST requests to form submission endpoints around the disclosure date of 23 May 2024.
Why it matters
The root cause is CWE-502, deserialization of untrusted data. When a PHP application unserializes data a visitor controls, the visitor can choose which object classes get built and what their properties hold. On its own that does little. Combined with a class elsewhere in the codebase whose magic methods do something dangerous, it becomes a property oriented programming chain.
That is why this flaw is awkward to size. The advisory says no chain exists in the plugin itself, yet any other installed plugin or theme could supply one. Your risk is a property of the whole site, not of one plugin. The record does not mark it as a CISA Known Exploited Vulnerabilities entry.
Quick check
Is CVE-2024-5085 exploited in the wild?
The record's KEV flag is false and the sources we have do not say it is exploited. That can change, so check the CISA catalog.
Why is a flaw with no known gadget chain rated high?
Scoring assumes the worst realistic outcome of the weakness class. Unauthenticated reach plus a possible chain from another plugin gives high impact ratings.
Sources
Last reviewed: 19 October 2026.
