WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA WP Cost Estimation & Payment Forms Builder (loopus) Fixed in 9.644
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25296
- 2026-10-03 Alias added: GHSA-9mvg-c5p5-q5f5
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ae50aa5d-95e3-4650-9dbf-118b4ba3abda?source=cve
- https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/
- https://www.zdnet.com/article/another-wordpress-commercial-plugin-gets-exploited-in-the-wild/
- https://wpscan.com/vulnerability/9219
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-cost-estimation-payment-forms-builder-multiple-vulnerabilities-9-642/
More loopus vulnerabilities
- TI-2026-22456 WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2026-19636 WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2025-16597 Missing authorization in loopus WP Attractive Donations System - Easy Stripe & Paypal… CVSS 3.1HIGH 7.5
- TI-2024-20213 WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
- TI-2019-15349 WP Cost Estimation < 9.660 - Upload Directory Traversal CVSS 3.1MEDIUM 6.5
- TI-2026-08129 Cross-site scripting in loopus WP Cost Estimation & Payment Forms Builder CVSS 3.1HIGH 7.2
Sources
- CVE-2019-25296 · CVE Program
- CVE-2019-25296 · NVD
- FIRST EPSS
- GHSA-9mvg-c5p5-q5f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences