CVE-2019-25295

MEDIUM

WP Cost Estimation <9.660 - Path Traversal

Title source: llm
STIX 2.1

Description

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0053
EPSS Percentile 40.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
loopus/WP Cost Estimation & Payment Forms Builder < 9.660
Published Jan 08, 2026
Tracked Since Feb 18, 2026