PT-2025-48608 · WordPress · Cost Calculator Builder

Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-12529

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cost Calculator Builder plugin for WordPress versions up to and including 3.6.3

Description The Cost Calculator Builder plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the deleteOrdersFiles() function. This allows unauthenticated attackers to inject arbitrary file paths into orders that are removed by an administrator. Exploitation could lead to remote code execution if a critical file, such as wp-config.php, is deleted. The Cost Calculator Builder Pro version must be installed alongside the free version for successful exploitation.

Recommendations Versions prior to 3.6.4 should be updated.

Fix

RCE

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-12529

Affected Products

Cost Calculator Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12529 · Security Note
• https://twitter.com/offseq/status/1995712833942651203 · Twitter Post
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L262 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1995834897315823622 · Twitter Post
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L513 · Note
• https://twitter.com/RedPacketSec/status/1995727008211341722 · Twitter Post
• https://twitter.com/CVEnew/status/1995688549589401805 · Twitter Post