Vulnerability Description
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://codecanyon.net/item/wp-cost-estimation-payment-forms-builder/7818230
- https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estima
- https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985
FAQ
What is CVE-2019-25295?
CVE-2019-25295 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a wh...
How severe is CVE-2019-25295?
CVE-2019-25295 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25295?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.