CVE-2019-25296
Arbitrary File Upload and Deletion in WP Cost Estimation Plugin
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | wp_cost_estimation | to 9.642 (inc) |
| unknown_vendor | wp_cost_estimation | to 9.644 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the WP Cost Estimation & Payment Forms Builder WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation in certain AJAX actions. Attackers can upload files with arbitrary extensions and then use a malicious .htaccess file to execute embedded PHP code, effectively enabling remote code execution. Additionally, attackers can delete files on the server, including critical configuration files, and replace them with malicious database files. This leads to site compromise, including hijacking site traffic and redirecting visitors to malicious sites. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to severe impacts including unauthorized remote code execution on the affected server, deletion of important files such as database configuration files, and replacement with malicious files. Attackers can hijack site traffic, redirect visitors to malicious websites, and potentially use the compromised site as part of botnets or other malicious activities. It can also result in unauthorized access and privilege escalation on the server hosting the WordPress site. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for unusual file uploads with non-standard extensions (e.g., .tss) or the presence of malicious .htaccess files that map these extensions to the PHP interpreter. Additionally, monitoring for unexpected file deletions, especially of configuration or database files, can indicate exploitation. Specific commands are not provided in the resources, but typical approaches include scanning the web server directories for suspicious files and reviewing web server logs for AJAX requests to lfb_upload_form and lfb_removeFile endpoints. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the WP Cost Estimation & Payment Forms Builder plugin to version 9.644 or later, which contains the security fix. Additionally, reviewing and removing any suspicious uploaded files or unauthorized changes, and monitoring the site for signs of compromise are recommended. [2]