CVE-2019-25295
WP Cost Estimation < 9.660 - Upload Directory Traversal
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
| CWE | CWE-22 |
| Vendor | loopus |
| Product | wp cost estimation & payment forms builder |
| Published | Jan 8, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for loopus wp cost estimation & payment forms builder
Be the first to know when new medium vulnerabilities affecting loopus wp cost estimation & payment forms builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
loopus / WP Cost Estimation & Payment Forms Builder
0 < 9.660
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78?source=cve wordfence.com: https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/ codecanyon.net: https://codecanyon.net/item/wp-cost-estimation-payment-forms-builder/7818230
Credits
Mikey Veenstra