CVE-2024-12201 identifies a missing authorization vulnerability (CWE-862) in the Hash Form – Drag & Drop Form Builder plugin for WordPress, present in all versions up to and including 1.2.1. The vulnerability arises because the plugin fails to perform proper capability checks when authenticated users attempt to create new form styles. Specifically, users with Contributor-level access or higher can exploit this flaw to create new form styles without the necessary permissions, bypassing intended access controls. The vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of form styles, which could be leveraged for further attacks such as UI manipulation or social engineering. The CVSS 3.1 base score is 4.3 (medium), reflecting low attack complexity (no user interaction needed), network attack vector, and low privileges required. No patches or exploits are currently publicly available, but the risk remains for sites using this plugin. The vulnerability is particularly relevant for WordPress sites that rely on this plugin for form creation and styling, potentially exposing them to unauthorized changes that could degrade user trust or site functionality.

The primary impact of this vulnerability is on the integrity of affected WordPress sites using the Hash Form plugin. Unauthorized users with Contributor-level access can create new form styles, potentially leading to unauthorized UI changes, phishing attempts, or misleading form presentations that could trick users or administrators. While confidentiality and availability are not directly impacted, the integrity compromise can facilitate further attacks or damage site reputation. Organizations relying on this plugin for customer-facing forms or internal workflows may experience degraded trust or operational issues. Since Contributor-level access is relatively low privilege, many users within an organization or community could exploit this flaw if they have authenticated access, increasing the risk surface. The vulnerability affects all versions of the plugin up to 1.2.1, so widespread installations remain at risk until mitigated.

To mitigate CVE-2024-12201, organizations should first check if an updated version of the Hash Form plugin is available that includes proper authorization checks and apply it immediately. If no official patch exists, administrators should implement custom access control measures to restrict form style creation to trusted roles only, such as Editors or Administrators, by modifying plugin code or using WordPress hooks to enforce capability checks. Additionally, review and limit Contributor-level user permissions to only trusted users and monitor form style creation activities for anomalies. Employing a Web Application Firewall (WAF) with rules targeting unauthorized form style creation attempts can provide temporary protection. Regularly audit user roles and plugin usage to detect unauthorized changes. Finally, maintain backups and have an incident response plan to quickly restore integrity if unauthorized modifications occur.