Improper control of filenames in PHP's include/require within HT Contact Form 7 allows a local file inclusion flaw. An attacker can supply a crafted path to load arbitrary files from the server, enabling read of sensitive data or execution of arbitrary code if a malicious file is present. The weakness is classified as CWE-98, indicating insufficient validation of user supplied file paths.

HT Plugins’ HT Contact Form 7 plugin, for all releases up to and including version 2.0.0, is affected. The vulnerability applies to any site that has the plugin installed at these versions, regardless of other configuration settings.

The CVSS score of 6.6 reflects a moderate severity. The EPSS score of less than 1% indicates a very low probability that the issue is being actively exploited. Because the vulnerability is not listed in CISA’s KEV catalog, there is no known active exploitation of this flaw. Exploitation would most likely occur through normal web traffic to the plugin’s contact form handling code; an attacker would need to supply a malicious path value to trigger the inclusion. No official workaround is noted, so the risk remains until the plugin is updated.