Arbitrary File Deletion Vulnerability in HT Contact Form Widget for WordPress

CVE-2025-7341

What is CVE-2025-7341?

The HT Contact Form Widget for Elementor Page Builder and Gutenberg Blocks suffers from a vulnerability that allows unauthenticated attackers to exploit insufficient file path validation in the temp_file_delete() function. This flaw is present in all versions up to and including 2.2.1. By exploiting this vulnerability, it is possible for attackers to delete arbitrary files on the server. If sensitive files are targeted, such as wp-config.php, this can lead to severe security breaches, including unauthorized remote code execution, posing a significant risk to WordPress installations.

References