PHP Local File Inclusion Vulnerability in HT Contact Form 7 by HT Plugins
CVE-2025-54015

6.6MEDIUM

Key Information:

Vendor

WordPress
Status
Ht Contact Form 7
Vendor
CVE Published:
16 July 2025

What is CVE-2025-54015?

A vulnerability in HT Plugins' HT Contact Form 7 allows for improper control over the filename in PHP's include/require statements. This leads to potential local file inclusion, enabling unauthorized access to sensitive files on the server. Affected versions range from n/a to 2.0.0, highlighting the importance of keeping the plugin up to date to mitigate associated security risks.

Affected Version(s)

HT Contact Form 7 <= 2.0.0

References

https://patchstack.com/database/wordpress/plugin/ht-conta...
vdb-entry

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.