Platform
wordpress
Component
ht-contactform
Fixed in
2.2.2
CVE-2025-7360 is a critical directory traversal vulnerability affecting the HT Contact Form WordPress plugin. This vulnerability allows unauthenticated attackers to move arbitrary files on the server, potentially leading to remote code execution. The vulnerability impacts versions 0.0.0 through 2.2.1, and a patch is available in version 2.2.2.
The core impact of CVE-2025-7360 lies in its potential for remote code execution. An attacker can exploit this vulnerability by manipulating file paths to move sensitive files, such as wp-config.php, to locations where they can be accessed or modified. Successful exploitation grants the attacker control over the WordPress installation, enabling them to execute arbitrary code, steal sensitive data (database credentials, user information), and potentially compromise the entire server. The ease of exploitation, combined with the plugin’s popularity, makes this a high-risk vulnerability.
CVE-2025-7360 was publicly disclosed on 2025-07-15. While no public proof-of-concept (PoC) has been released, the ease of exploitation and the potential for RCE suggest a medium probability of exploitation. The vulnerability has been added to the CISA KEV catalog, indicating a heightened level of concern. Active campaigns targeting WordPress plugins are common, increasing the likelihood of exploitation.
Exploit Status
EPSS
1.11% (78% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-7360 is to immediately upgrade the HT Contact Form plugin to version 2.2.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file upload permissions for unauthenticated users, implementing stricter file path validation within the plugin (if possible), and using a Web Application Firewall (WAF) to block suspicious file upload requests. Monitor WordPress logs for unusual file access patterns, particularly attempts to access or modify wp-config.php. After upgrading, verify the fix by attempting a file upload with a manipulated path to confirm that the vulnerability is no longer exploitable.
Update the HT Contact Form plugin to version 2.2.2 or higher to mitigate the directory traversal vulnerability. This update corrects the inadequate file path validation, preventing attackers from moving arbitrary files on the server.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-7360 is a critical vulnerability allowing attackers to move files on a WordPress server, potentially leading to remote code execution, affecting versions 0.0.0–2.2.1 of the HT Contact Form plugin.
You are affected if your WordPress site uses the HT Contact Form plugin and is running a version between 0.0.0 and 2.2.1. Check your plugin version immediately.
Upgrade the HT Contact Form plugin to version 2.2.2 or later to resolve the vulnerability. If immediate upgrade isn't possible, implement temporary workarounds like WAF rules and file permission restrictions.
While no public exploit is currently available, the vulnerability's severity and ease of exploitation suggest a medium probability of active exploitation. Monitor your systems closely.
Refer to the official HT Contact Form plugin website or WordPress plugin repository for the latest advisory and update information regarding CVE-2025-7360.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.