CVE-2019-25295

WP Cost Estimation < 9.660 - Upload Directory Traversal

CVSS 6.5 MEDIUMEPSS 0.5%CWE-22

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

loopus · WP Cost Estimation & Payment Forms Builder

References

https://codecanyon.net/item/wp-cost-estimation-payment-forms-builder/7818230 https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78?source=cve