The HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress suffers from improper privilege management (CWE-269) that enables unauthenticated attackers to delete arbitrary files on the server. This is caused by insufficient validation of file paths in the temp_file_delete() function in all plugin versions up to and including 2.2.1. Exploitation can lead to remote code execution by deleting critical files such as wp-config.php. The vulnerability is remotely exploitable without any privileges or user interaction, reflected by a CVSS 3.1 base score of 9.1.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server, potentially leading to remote code execution. This can compromise the entire WordPress installation and underlying server, resulting in full system compromise or denial of service. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation.