CVE-2026-78280
Received Received - Intake

Unauthenticated CSRF in Hash Form <= 1.4.0

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78280
EUVD
EUVD-2026-64787

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack hash_form to 1.4.0 (inc)
patchstack hash_form_plugin to 1.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78280 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress Hash Form plugin versions 1.4.0 and below. It allows attackers to trick users into executing unwanted actions on the website without their consent.

Detection Guidance

Detecting this CSRF vulnerability requires checking the installed version of the Hash Form plugin. Use WordPress admin dashboard to view the plugin version or run SQL query: SELECT * FROM wp_options WHERE option_name LIKE '%hash_form%'; in your WordPress database. Alternatively, use WP-CLI command: wp plugin list | grep hash-form to check the version.

Impact Analysis

This vulnerability could allow attackers to perform unauthorized actions on your WordPress site if you interact with a malicious link or page. For example, they might change settings, create posts, or modify content without your permission.

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized actions to be performed on behalf of authenticated users. Exploitation might lead to unauthorized data modifications or access, which could violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update the Hash Form plugin to version 1.4.1 or later. Enable auto-updates for vulnerable plugins if using Patchstack. Remove unused plugins and monitor for suspicious user activity. Ensure WordPress core, themes, and other plugins are updated to latest versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart