What is the CVSS score of CVE-2025-7341?

CVE-2025-7341 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of PHP are affected by CVE-2025-7341?

CVE-2025-7341 is a critical arbitrary file deletion vulnerability in HT Contact Form Widget For Elementor affecting all versions through 2.2.1, allowing unauthenticated attackers to delete essential…. A patch is available.

How to fix or mitigate CVE-2025-7341?

Within 24 hours: Identify all WordPress instances using HT Contact Form Widget For Elementor through plugin audit; immediately disable or deactivate the plugin if version 2.2.1 or earlier is detected. Within 7 days: Apply vendor patch (changeset 3326887 or later) to upgrade HT Contact Form Widget For Elementor to version 2.2.2 or newer on all affected installations. Within 30 days: Verify successful patch deployment across all sites, re-enable the plugin after validation, and implement file integrity monitoring on critical WordPress files (wp-config.php, wp-load.php).

PHP CVE-2025-7341

CRITICAL

Improper Privilege Management (CWE-269)

2025-07-15 security@wordfence.com

WordPress Privilege Escalation RCE PHP Download Contact Form 7 Widget For Elementor Page Builder Gutenberg Blocks Elementor

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

Patch released

Apr 08, 2026 - 18:38 nvd

Patch available

CVE Published

Jul 15, 2025 - 05:15 nvd

CRITICAL 9.1

DescriptionCVE.org

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

AnalysisAI

Arbitrary file deletion in HT Contact Form Widget For Elementor (WordPress plugin) allows unanetworks attackers to remove critical server files, enabling remote code execution. Affecting all versions through 2.2.1, the vulnerability stems from insufficient path validation in temp_file_delete(), permitting deletion of wp-config.php or other essential files. CVSS 9.1 (Critical) with network attack vector, low complexity, and no authentication required. Vendor patch available (changeset 3326887). No public exploit identified at time of analysis, though the attack path is straightforward for skilled adversaries.

Technical ContextAI

This vulnerability resides in the FileManager.php component of the HT Contact Form Widget plugin, specifically within the temp_file_delete() function called via Ajax.php. The flaw represents CWE-269 (Improper Privilege Management), where the function fails to validate user-supplied file paths before executing deletion operations. WordPress plugins running with web server privileges can access any file writable by the PHP process. By manipulating the file path parameter in an unauthenticated AJAX request, attackers can traverse directories and target critical WordPress core files like wp-config.php (containing database credentials and security keys) or .htaccess. Deleting wp-config.php forces WordPress into installation mode, allowing attackers to reconfigure the site with attacker-controlled database credentials, achieving remote code execution. The CPE identifier confirms this affects HasThemes' Download Contact Form 7 Widget for Elementor Page Builder & Gutenberg Blocks plugin across WordPress installations.

RemediationAI

Update immediately to the patched version available via WordPress plugin repository following changeset 3326887 released in early May 2025. Administrators should access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate HT Contact Form Widget, and click Update Now. For sites with automatic updates enabled, verify the patch has been applied by checking that the version exceeds 2.2.1. If immediate updates are not feasible, temporarily deactivate the plugin until patching is complete. Review web server logs for suspicious AJAX requests to admin-ajax.php targeting the temp_file_delete function, specifically looking for path traversal patterns (../, absolute paths). Verify integrity of wp-config.php and other critical WordPress files. Consult the official vendor advisory and patch details at https://plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Ajax.php and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/32da04ba-bee3-4fd3-b91b-57e588d5f4e4.