CVE-2025-7340 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

🗓️ 15 Jul 2025 04:23:42Reported by WordfenceType

HT Contact Form Widget for WordPress allows unauthenticated file uploads, risking server security.

Reporter	Title	Published	Views	Family All 16
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hasthemes Download_Contact_Form_7_Widget_For_Elementor_Page_Builder_\&_Gutenberg_Blocks	14 Jul 202523:27	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Hasthemes Download_Contact_Form_7_Widget_For_Elementor_Page_Builder_\&_Gutenberg_Blocks	4 Aug 202514:30	–	githubexploit
Circl	CVE-2025-7340	15 Jul 202503:00	–	circl
CNNVD	WordPress plugin HT Contact Form 代码问题漏洞	15 Jul 202500:00	–	cnnvd
CVE	CVE-2025-7340	15 Jul 202504:23	–	cve
EUVD	EUVD-2025-21412	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7340	15 Jul 202505:15	–	nvd
Packet Storm News	WordPress HT Contact Form Widget 2.2.1 Shell Upload	15 Jul 202500:00	–	packetstormnews
Patchstack	WordPress HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin <= 2.2.1 - Unauthenticated Arbitrary File Upload vulnerability	14 Jul 202521:14	–	patchstack
Positive Technologies	PT-2025-29532	14 Jul 202500:00	–	ptsecurity

[
  {
    "vendor": "htplugins",
    "product": "HT Contact Form – Drag & Drop Form Builder for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f0cb666b-bfab-492f-a74e-11dc9b171136
plugins	www.plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Services/FileManager.php
plugins	www.plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Services/FileManager.php

08 Apr 2026 17:32Current

CVSS 3.19.8

EPSS0.01967

CWE-434