CVE-2025-7360: Critical Arbitrary File Move in HT Contact Form

CVE-2025-7360 is a critical (CVSS 9.1) arbitrary file move flaw in the HT Contact Form Widget for Elementor Page Builder and Gutenberg Blocks plugin for WordPress. Versions up to and including 2.2.1 are affected, and no login is needed. Update the plugin.

What's affected

The record says the plugin (slug ht-contactform) is vulnerable in all versions up to and including 2.2.1. The cause is insufficient file path validation in the handle_files_upload() function. An unauthenticated attacker can move arbitrary files on the server, and the record says this can easily lead to remote code execution when the right file is moved, with wp-config.php as the example.

The record gives no fixed version. The wordpress.org changelog shows 2.2.2 as the next release, dated 10 July 2025, with improved file upload handling and file type validation plus a file name sanitization fix. It does not name this CVE, and I could not open the Wordfence entry or the code change pages listed in the record. Treat 2.2.2 as the first release after the affected range and confirm it in the Wordfence entry. Better, run the latest release. At the time I checked, wordpress.org listed 2.10.3.

The vector is network reachable with low complexity, no privileges and no user interaction, no confidentiality impact and high integrity and availability impact. The weakness is CWE-22, path traversal. The record's KEV flag is false, and nothing I read says it is exploited.

The same plugin has a companion flaw, CVE-2025-7341, an arbitrary file deletion. Both sit in the same version range, so one update covers both.

How to check if you're exposed

Read the installed version:

wp plugin list --name=ht-contactform --fields=name,status,version

If WP-CLI is not available, open the Plugins page in the WordPress admin and read the version under the plugin name. Anything at 2.2.1 or lower is in the affected range.

Check each site on your estate, including staging copies that are reachable from the internet. A plugin that is installed but inactive can still leave files on disk, so also look for the folder:

find /var/www -type d -name ht-contactform

If the version is 2.2.1 or lower, assume exposure. Check that wp-config.php and other core files are where they should be. A moved file is harder to spot than a deleted one, so also look for unexpected files in the uploads folder and for config files that appear in odd places. Review web server logs for strange requests to the plugin's submission endpoints.

What to do now

1. Find every WordPress site that has the plugin.
2. Update to the latest release, or remove the plugin if it is unused.
3. Take a backup first. Run wp plugin update ht-contactform or update from the admin screen.
4. Confirm core files, wp-config.php and the uploads folder look right, and restore from backup if they do not.
5. Review logs for the period the vulnerable version was live.
6. Subscribe to advisories for the plugins you run, so the next one is not a surprise.

Why it matters

Moving a file is a quiet way to break a site or take it over. Move wp-config.php away and WordPress behaves as if it were not installed. Move a file into a place the server executes, and a harmless upload can become code. The record describes this as an easy path to remote code execution.

The cause is the same one that shows up again and again in upload handlers: a path from the request is used without being checked against the folder the code is meant to work in. The right design takes the file name out of the request's hands, picks a safe destination and refuses anything that resolves outside it.

Quick check

Sources

• CVE-2025-7360 on Safeguard Gold
• HT Contact Form on wordpress.org (changelog)
• Wordfence entry for this issue (could not be read when I checked)

Last reviewed: 18 October 2026.