Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-12529: Cost Calculator Builder plugin on WordPress deletes files without checking paths

CVE-2025-12529 · published 11 months ago

Summary

The Cost Calculator Builder plugin for WordPress can delete any file on your site if an attacker tricks an admin into deleting orders. This could allow an attacker to delete sensitive files, potentially giving them control over your site. Update the plugin to the latest version to fix this issue.

Original advisory text

The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-73External Control of File Name or Path

Timeline

Published2 Dec 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-12529 · NVD

Track software like this

Free during beta