Description
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hashthemes | Hash Form | ≤ 1.4.1 | — |
Critical · 9.8
CVE-2026-78292
EUVD-2026-66946GHSA-j565-hhqc-8rx3
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Published Aug 27, 2026 · Updated Aug 27, 2026 · Assigned by Patchstack