Back
Thousands of WordPress Sites at Risk from HT Contact Form Plugin Bug

Thousands of WordPress Sites at Risk from HT Contact Form Plugin Bug

WARNING Publication date: 2025-07-29

A series of critical vulnerabilities has been discovered in the widely used WordPress plugin HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder, affecting more than 10,000 websites. The flaws allow unauthenticated attackers to perform remote code execution (RCE), delete critical files, or move server files in ways that could result in full site compromise. While a security patch has been released, data from WordPress.org shows that the majority of installations have not been updated.

 

Summary of CVEs and Vulnerabilities

Three distinct vulnerabilities have been assigned official CVE identifiers:

 

  • CVE-2025-7340 – Arbitrary File Upload. Allows attackers to upload malicious files and execute code remotely.
    CVSS Score: 9.8
  • CVE-2025-7341 – Arbitrary File Deletion. Attackers can delete any file on the server, including critical configuration files.
    CVSS Score: 9.1
  • CVE-2025-7360 – Arbitrary File Move. Allows unauthorized relocation of files, such as wp-config.php, which can lead to full site takeover.
    CVSS Score: 9.1

 

The vulnerabilities are present in plugin versions 2.2.1 and earlier. The vendor, HasTech IT, issued a patch in version 2.2.2 on July 13, 2025. Despite this, adoption of the patched version remains limited.

 

Affected CPEs:


    cpe:2.3:a:hastech:ht_contact_form:*:*:*:*:*:wordpress:*:*

This CPE entry applies to all versions up to and including 2.2.1.

 

Technical Background

 

The root causes of these vulnerabilities lie in insufficient input validation:

  • The plugin allowed unrestricted file uploads without validating file type or extension, enabling .php files to be uploaded directly into publicly accessible directories.
  • File deletion and move operations failed to sanitize or constrain file paths, allowing attackers to target arbitrary locations on the server.

 

In response, the developer has added checks using wp_check_filetype() and sanitize_file_name() to prevent malicious exploitation.

 

Timeline of Disclosure

  • June 24, 2025: Initial report submitted to Wordfence for arbitrary upload and deletion vulnerabilities
  • July 4, 2025: Additional report submitted for arbitrary file move
  • July 9, 2025: Vendor received full details and acknowledged the issue
  • July 13, 2025: Version 2.2.2 released, resolving all known issues

 

What You Should Do

  1. Update the plugin immediately to version 2.2.2 or later.
  2. Verify your current plugin version from the WordPress admin dashboard.
  3. Define your WordPress installation and plugins in BaseFortify.eu to monitor for known vulnerabilities in the future.

 

BaseFortify will automatically alert you when plugins in your stack are affected by critical CVEs, helping you respond quickly to security threats.

 

More information

 

If you're not already using BaseFortify, register today to stay ahead of plugin vulnerabilities affecting your website.