What the vulnerability does
01Description
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
02Summary
HT Contact Form versions up to 2.2.1 contain a path traversal vulnerability that allows unauthenticated attackers to modify or delete files on the site through specially crafted requests. No user interaction is required. The vulnerability affects file integrity and availability, potentially compromising the entire WordPress installation.
What an attacker can do
03Attacker Capabilities
Modify or delete files on the site without authentication.
Potential impact on your site
04Site Impact
Attackers can alter or remove critical WordPress files, causing data loss or site takeover.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 15, 2025
CVE published
April 8, 2026
Record updated
