CVE-2025-7340
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Analysis
Unauthenticated remote code execution in HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks plugin (all versions ≤2.2.1) allows attackers to upload arbitrary files to the WordPress server. Missing file type validation in temp_file_upload() function enables unrestricted file uploads, permitting execution of malicious scripts. Critical severity (CVSS 9.8) due to network-accessible attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis.
Technical Context
Root cause: absent MIME type and extension validation in FileManager.php temp_file_upload() function (CWE-434). Unauthenticated attackers exploit direct function access to bypass upload restrictions, placing executable payloads (e.g., PHP web shells) in web-accessible directories. CVSS vector PR:N confirms no authentication barrier; complete confidentiality/integrity/availability impact.
Affected Products
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks (HasThemes), WordPress plugin versions ≤2.2.1. CPE: cpe:2.3:a:hasthemes:download_contact_form_7_widget_for_elementor_page_builder_&_gutenberg_blocks:*:*:*:*:*:wordpress:*:*
Remediation
Vendor-released patch available via WordPress plugin repository. Upgrade immediately to version 2.2.2 or later through WordPress admin dashboard (Plugins > Updates). Upstream fix visible in Trac changeset 3326887 addressing FileManager.php validation logic. If immediate upgrade is not feasible, deactivate and remove the plugin entirely until patching is complete. Workaround: implement web application firewall rules blocking unauthenticated POST requests to /wp-admin/admin-ajax.php with action parameters matching plugin upload handlers. Post-remediation: audit server file systems for unauthorized uploads in /wp-content/uploads/ and temporary directories; review access logs for exploitation attempts targeting temp_file_upload. Advisory URL: https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cb666b-bfab-492f-a74e-11dc9b171136
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today