Arbitrary File Upload Vulnerability in HT Contact Form Widget for Elementor Page Builder
CVE-2025-7340

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Ht Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder.
Vendor
CVE Published:
15 July 2025

What is CVE-2025-7340?

The HT Contact Form Widget for Elementor Page Builder and Gutenberg Blocks is susceptible to an arbitrary file upload vulnerability. This issue arises from inadequate file type validation in the temp_file_upload function across all versions up to and including 2.2.1. As a result, unauthenticated attackers can exploit this flaw to upload malicious files to the server, potentially enabling remote code execution.

Affected Version(s)

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. * <= 2.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ht-contactform...
https://plugins.trac.wordpress.org/changeset/3326887/ht-c...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.