Lifecycle Timeline
2DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.
AnalysisAI
Local file inclusion vulnerability in HT Contact Form 7 plugin version 2.0.0 and earlier allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and source code. The vulnerability exists in PHP file inclusion/require statements that fail to properly validate or sanitize user-supplied input, enabling attackers to traverse the directory structure and access files outside the intended directory scope. With an EPSS score of 0.14% indicating low exploitation probability despite the technical capability, this vulnerability requires direct web interaction but poses information disclosure risks rather than remote code execution.
Technical ContextAI
This vulnerability exploits improper input validation in PHP's include() or require() language constructs, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The HT Contact Form 7 WordPress plugin fails to adequately sanitize user-controllable input before passing it to file inclusion functions, allowing attackers to use directory traversal sequences (such as ../ or absolute paths) to access files outside the plugin's intended directory. The affected component processes user input (likely from GET/POST parameters or form submissions) without whitelisting allowed files or implementing proper path canonicalization, creating a local file inclusion (LFI) condition. WordPress plugins are particularly exposed to this attack vector because they operate within the web-accessible directory structure, and the plugin's contact form functionality suggests it accepts user-supplied parameters that reach vulnerable code paths.
Affected ProductsAI
HT Contact Form 7 WordPress plugin versions from initial release through 2.0.0 are affected. The plugin is distributed through the official WordPress plugin repository and is identifiable by slug 'ht-contactform'. Organizations using any version of HT Contact Form 7 up to and including version 2.0.0 should apply updates immediately. No specific CPE identifier was provided in the intelligence data, but the vulnerability affects the WordPress plugin ecosystem and impacts web applications leveraging this contact form solution for user submissions.
RemediationAI
Immediately upgrade HT Contact Form 7 to a version newer than 2.0.0 released by HT Plugins after the vulnerability disclosure. Update the plugin through the WordPress admin dashboard (Plugins > Installed Plugins > HT Contact Form 7 > Update) or via command line (wp plugin update ht-contactform if using WP-CLI). After upgrading, verify the plugin version in the WordPress plugin listing to confirm successful installation. If a newer patched version is not yet available, disable or remove the HT Contact Form 7 plugin entirely until the vendor releases a fix. Refer to the security advisory at https://patchstack.com/database/Wordpress/Plugin/ht-contactform/vulnerability/wordpress-ht-contact-form-7-plugin-2-0-0-local-file-inclusion-vulnerability for detailed patch release information and timeline. Additionally, review server access logs and web application firewall (WAF) logs for potential exploitation attempts using path traversal patterns (../ or ../../) targeting sensitive files like wp-config.php.
Share
External POC / Exploit Code
Leaving vuln.today