Arbitrary File Upload Vulnerability in HT Contact Form Widget for Elementor Page Builder
CVE-2025-7340

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Ht Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder.
Vendor
CVE Published:
15 July 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-7340?

The HT Contact Form Widget for Elementor Page Builder and Gutenberg Blocks is susceptible to an arbitrary file upload vulnerability. This issue arises from inadequate file type validation in the temp_file_upload function across all versions up to and including 2.2.1. As a result, unauthenticated attackers can exploit this flaw to upload malicious files to the server, potentially enabling remote code execution.

Affected Version(s)

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. * <= 2.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-7340
Created by Nxploited

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ht-contactform...
https://plugins.trac.wordpress.org/changeset/3326887/ht-c...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.