nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25296 CVE-2019-25296
CRITICAL
WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete
Record summary
CVE-2019-25296 has a selected CVSS score of 9.8 (critical).
Description
The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Feb 13, 2019 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
WP Cost Estimation PluginBrowse Loopus Plugins / WP Cost Estimation Plugin | VulnCheck | Version data not supplied | |
WP Cost Estimation & Payment Forms BuilderBrowse loopus / WP Cost Estimation & Payment Forms BuilderDefault status: unaffected | CVE List | Before 9.644 | affected |
References
6wpscan.com
https://wpscan.com/vulnerability/9219 acunetix.com
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-cost-estimation-payment-forms-builder-multiple-vulnerabilities-9-642 wordfence.com
https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae50aa5d-95e3-4650-9dbf-118b4ba3abda?source=cve zdnet.com
https://www.zdnet.com/article/another-wordpress-commercial-plugin-gets-exploited-in-the-wild