Overview
CVE-2025-7360 is a critical vulnerability that resides in the HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress. This vulnerability, if exploited, allows an unauthenticated attacker to move arbitrary files on the server, potentially leading to remote code execution. A successful exploit can result in a full system compromise or data leakage, impacting the confidentiality, integrity, and availability of the affected system. This vulnerability underscores the importance of proper file path validation in web applications and the potential consequences of not securing all endpoints.
Vulnerability Summary
CVE ID: CVE-2025-7360
Severity: Critical (CVSS 9.1)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder | <= 2.2.1 How the Exploit Works
The vulnerability exists in the handle_files_upload() function of the HT Contact Form Widget For WordPress. This function does not adequately validate file paths, enabling an attacker to move arbitrary files. If an attacker moves a sensitive file like “wp-config.php”, they can manipulate the configuration of the WordPress site, potentially leading to remote code execution.
Conceptual Example Code
Here is a conceptual example of how an unauthenticated attacker might exploit this vulnerability:
POST /wp-content/plugins/ht-contactform/upload.php HTTP/1.1
Host: vulnerable-wordpress-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="wp-config.php"
Content-Type: application/x-php
<?php
// malicious payload here
?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, the attacker is attempting to upload a malicious “wp-config.php” file to the server, which if successful, could allow them to execute arbitrary code.
Mitigation
To mitigate this vulnerability, users should immediately apply the vendor-provided patch. If a patch cannot be applied immediately, a web application firewall (WAF) or intrusion detection system (IDS) can be used as a temporary mitigation measure to block attempts to exploit this vulnerability. Additionally, configuring the server to limit the file types that can be moved or uploaded can further reduce the risk.