CVE-2024-9417 is a CWE-434 vulnerability affecting the Hash Form – Drag & Drop Form Builder plugin for WordPress, present in all versions up to 1.1.9. The issue stems from improper validation of uploaded file types in the 'handleUpload' function, which allows unauthenticated attackers to upload files that bypass both the allowedExtensions and unallowed_extensions checks. This can lead to the upload of potentially malicious files, including those that may execute cross-site scripting attacks. The vulnerability has a CVSS v3.1 base score of 6.1 (medium severity), with an attack vector of network, no privileges required, user interaction required, and partial impact on confidentiality and integrity. No patch or official remediation has been provided as of the published date.

An attacker can upload files with dangerous or unexpected types to a vulnerable WordPress site using the affected plugin, potentially enabling cross-site scripting attacks. This can lead to partial compromise of confidentiality and integrity of the affected site. There is no indication of impact to availability. The vulnerability is exploitable remotely without authentication but requires user interaction (e.g., victim visiting a crafted page). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for plugin updates from hashthemes is recommended to apply any forthcoming patches promptly.