The vulnerability CVE-2025-54015 affects HT Plugins HT Contact Form 7 up to version 2.0.0. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with certain privileges to include and execute arbitrary local files on the server. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to local file inclusion, potentially allowing an attacker with sufficient privileges to read or execute arbitrary files on the affected system. This impacts confidentiality, integrity, and availability of the system. However, exploitation requires high privileges and high attack complexity, reducing the likelihood of remote exploitation without prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should restrict access to the affected plugin and ensure that only trusted users have high privileges. Monitor vendor channels for updates and apply official patches once available.