CVE-2019-25295: The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows…

PriorityP338medium6.5CVSS 3.1

AVNACLPRNUINSUCNILAL

EPSS

0.53%

40.6th percentile

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
loopus	wp_cost_estimation_payment_forms_builder	< 9.660	9.660

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.