{"id":4883,"date":"2025-07-29T23:44:59","date_gmt":"2025-07-29T23:44:59","guid":{"rendered":"https:\/\/areeblog.com\/?p=4883"},"modified":"2025-07-29T23:44:59","modified_gmt":"2025-07-29T23:44:59","slug":"critical-flaws-in-wordpress-plugin-expose-10000-sites-to-takeover","status":"publish","type":"post","link":"https:\/\/areeblog.com\/critical-flaws-in-wordpress-plugin-expose-10000-sites-to-takeover\/","title":{"rendered":"Critical Flaws in WordPress Plugin Expose 10,000+ Sites to Takeover"},"content":{"rendered":"

\"Critical<\/p>\n

More than 10,000 WordPress websites were vulnerable to complete compromise<\/a> due to three severe security flaws discovered in the “HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder” plugin.<\/p>\n

Security firm Wordfence detailed the vulnerabilities in a new advisory. All three flaws, exploitable by unauthenticated attackers, could lead to full site takeover:<\/p>\n

1. Arbitrary File Upload (CVE-2025-7340, CVSS 9.8):<\/strong> The plugin’s temp_file_upload()<\/code> function lacked file type validation. Attackers could upload any file, including executable PHP scripts, to public directories for direct access and execution.<\/p>\n

2. Arbitrary File Deletion (CVE-2025-7341):<\/strong> Exploiting the temp_file_delete()<\/code> function, attackers could delete critical files like wp-config.php<\/code>. This would force the site into setup mode, enabling attacker control if pointed to a new database.<\/p>\n

3. Arbitrary File Move (CVE-2025-7360):<\/strong> The handle_files_upload()<\/code> function failed to properly sanitize file names, allowing attackers to move essential files. This could trigger the same level of compromise as file deletion.<\/p>\n

Researchers vgo0 and Phat RiO reported the flaws to Wordfence through its bug bounty program. Wordfence notified plugin developer HasTech IT on July 8, 2025. A patched version was released on July 13, 2025.<\/p>\n

To mitigate such risks, WordPress site owners should:<\/p>\n