CVE-2024-12201: Hashthemes Hash Form

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.

Affected products

• Hashthemes Hash Form: before 1.2.2 (fixed in 1.2.2)

Published 2024-12-12. Last modified 2026-06-17.