The HT Contact Form widget for Elementor and Gutenberg blocks contains a Directory Traversal flaw in its file upload handling that permits an unauthenticated attacker to move any file on the server. By specifying a crafted file path, an actor can overwrite critical files such as wp‑config.php, thereby enabling arbitrary code execution. The weakness is a classic directory traversal bug (CWE‑22).

The vulnerability affects the HT Contact Form – Drag & Drop Form Builder plugin for WordPress, versions up to and including 2.2.1, running on a WordPress installation.

The CVSS score of 9.1 signals severe impact, and the EPSS score of 1% indicates that while exploitation is feasible, current threat data suggests a low but non‑zero probability of attack. The plugin’s upload endpoint is publicly accessible, so attackers need only craft a malicious request; no prior authentication is required. Because the flaw can overwrite arbitrary files, the potential for full system compromise is high, and the vulnerability is not yet listed in the CISA KEV catalog.