CVE-2025-7341

Name of the Vulnerable Software and Affected Versions HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder versions up to and including 2.2.1

Description The HT Contact Form Widget plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation within the temp file delete() function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are deleted.

Recommendations HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder versions prior to 2.2.1 should be updated.