CVE-2024-5085 is a PHP Object Injection vulnerability in the Hash Form – Drag & Drop Form Builder WordPress plugin (versions up to 1.1.0). It arises from unsafe deserialization of untrusted data in the 'process_entry' function, enabling unauthenticated attackers to inject PHP objects. The plugin itself lacks a known POP chain, but if combined with other plugins or themes that provide such chains, it could lead to critical impacts including arbitrary file deletion, data theft, or remote code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1. No patch or remediation information is currently available.

Successful exploitation can lead to high-impact consequences such as arbitrary file deletion, sensitive data exposure, or remote code execution, contingent on the presence of a POP chain in the target environment. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, consider disabling or removing the vulnerable plugin to mitigate risk. Monitor vendor channels for updates and apply any official fixes promptly once available.