Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-7360

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).

Published

2025-07-15T05:15:30.070

Last Modified

2025-07-16T14:29:35.580

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hasthemes download_contact_form_7_widget_for_elementor_page_builder_\&_gutenberg_blocks < 2.2.2 Yes
References