CVE-2025-7360: HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handlefilesupload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builderto a version that resolves this vulnerability.Fixed in 2.2.1 - Compensating control
Mitigate exploitation by preventing unauthenticated access to the vulnerable file upload functionality (e.g., ensure only authenticated/trusted users can upload files related to the plugin and restrict access to the plugin’s upload/handler endpoints via web server or WAF).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7360?
CVE-2025-7360 is classified as a high severity vulnerability due to arbitrary file moving risks.
How do I fix CVE-2025-7360?
To fix CVE-2025-7360, update the HT Contact Form Widget for Elementor Page Builder to version 2.2.2 or later.
Which versions are affected by CVE-2025-7360?
CVE-2025-7360 affects all versions of the HT Contact Form Widget for Elementor Page Builder up to and including 2.2.1.
What type of attacks can CVE-2025-7360 lead to?
CVE-2025-7360 can lead to arbitrary file uploads and potential remote code execution on the affected WordPress site.
Who is affected by CVE-2025-7360?
WordPress users running the HT Contact Form Widget for Elementor Page Builder versions up to 2.2.1 are at risk from CVE-2025-7360.