The plugin processes file uploads without restricting MIME types, a flaw catalogued as CWE‑434. Unauthenticated users can upload any file to the server. If a malicious script is placed in a web‑accessible directory, it can be executed, giving the attacker full control over the affected WordPress installation and compromising all aspects of the site.

The vulnerability applies to the htplugins HT Contact Form – Drag & Drop Form Builder for WordPress plugin, versions up to and including 2.2.1. Sites using this plugin in those releases are at risk.

With a CVSS score of 9.8 the weakness is considered critical. The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, suggesting a very low current exploitation rate. Nevertheless, the attack path is simple: an unauthenticated attacker posts a file to the plugin’s upload endpoint, and if the server executes the file, remote code execution follows. No additional access or configuration is required beyond the upload action.