CVE-2025-7341: HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the tempfiledelete() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin "HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder"to a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7341?
CVE-2025-7341 has a high severity rating due to its potential for arbitrary file deletion.
How do I fix CVE-2025-7341?
To fix CVE-2025-7341, update the HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder to version 2.2.2 or later.
What versions of HT Contact Form Widget are affected by CVE-2025-7341?
All versions up to and including 2.2.1 of the HT Contact Form Widget are affected by CVE-2025-7341.
What could an attacker gain by exploiting CVE-2025-7341?
An attacker exploiting CVE-2025-7341 could potentially delete arbitrary files, leading to loss of data or further attacks.
Is CVE-2025-7341 related to WordPress security?
Yes, CVE-2025-7341 is specifically a vulnerability found in a WordPress plugin, affecting WordPress site security.