CVE-2025-7341 is a critical (CVSS 9.1) arbitrary file deletion flaw in the HT Contact Form Widget for Elementor Page Builder and Gutenberg Blocks plugin for WordPress. Versions up to and including 2.2.1 are affected, and unauthenticated visitors can trigger it. Update the plugin.
What's affected
The record says the plugin, slug ht-contactform, is vulnerable in all versions up to and including 2.2.1. The cause is insufficient file path validation in the temp_file_delete() function. An unauthenticated attacker can delete arbitrary files on the server. The record adds that this can easily lead to remote code execution when the right file is deleted, with wp-config.php as the example.
Which version fixes it? The record gives no fixed version. The plugin's changelog on wordpress.org shows 2.2.2 as the next release after 2.2.1, dated 10 July 2025, and it lists improved file upload handling with file type validation and a file name sanitization fix. It does not name this CVE. I could not open the Wordfence entry or the code change pages in the record, so treat 2.2.2 as the first release after the affected range and confirm in the Wordfence entry. The simplest path is to run the latest version. At the time I checked, wordpress.org listed 2.10.3, and the changelog since 2.2.2 includes several further security fixes.
The CVSS vector is network reachable, low complexity, no privileges and no user interaction, with no confidentiality impact and high integrity and availability impact. The weakness is listed as CWE-269 (improper privilege management), although the description reads like a path validation problem. The record is not in the CISA KEV catalog (the KEV flag is false), and nothing I read says it is exploited.
A related record, CVE-2025-7360, covers an arbitrary file move in the same plugin and the same version range.
How to check if you're exposed
Read the installed version:
wp plugin list --name=ht-contactform --fields=name,status,version
If WP-CLI is not available, open the Plugins page in the WordPress admin and read the version under the plugin name. Anything at 2.2.1 or lower is in the affected range.
On a fleet, run the same command on each site, or use your management tool's plugin inventory. Also search for the plugin folder on disk in case it is installed but inactive, since deactivation does not always remove reachable files:
find /var/www -type d -name ht-contactform
If you find it at 2.2.1 or lower, assume the site is exposed. Check that wp-config.php and other core files are still present and unchanged, and look at your web server logs for unusual requests to the plugin's endpoints. A missing core file is a sign worth acting on straight away.
What to do now
- Find every WordPress site that has the plugin.
- Update it to the latest release, or remove it if you do not use it.
- Take a backup first. Run
wp plugin update ht-contactformor use the admin screen. - Verify that core files and
wp-config.phpare intact, and restore from backup if anything is missing. - Review access logs for the period since the plugin was installed.
- Add the plugin to the list you check each week for new advisories.
Why it matters
Deleting a file looks less dangerous than writing one, but the record points out why it is not. Remove wp-config.php and WordPress treats the site as uninstalled, which can open an installer to the next visitor. That is the path from file deletion to code execution that the record describes.
The root problem is trusting a file path that comes from a request. The code should map the request to a file it chose itself and confirm the result sits inside a folder it owns. Form plugins are attractive because they sit on public pages and handle files by design.
Try it yourself
See how continuous monitoring flags a newly disclosed issue in software you already run.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to be attacked?
No. The record says unauthenticated attackers can trigger it, and the vector shows no privileges required.
Is 2.2.2 enough?
It is the first release after the affected range, per the plugin's changelog, but the changelog does not name this CVE. Confirm in the Wordfence entry, or simply update to the latest release.
Sources
- CVE-2025-7341 on Safeguard Gold
- HT Contact Form on wordpress.org (changelog)
- Wordfence entry for this issue (could not be read when I checked)
Last reviewed: 18 October 2026.
