CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
Explanation of Vulnerability in Simple Terms
WP Cost Estimation & Payment Forms Builder versions before 9.660 contain a path traversal vulnerability that allows an attacker to manipulate file paths and modify or delete files on the server. No authentication is required to exploit this flaw. The vulnerability affects the plugin's file handling logic, enabling unauthorized modification of site data or temporary files.
What an attacker can do
Modify or delete files on the server without authentication.
Potential impact on your site
Attackers can corrupt or delete critical plugin files, configuration data, or temporary files, disrupting site functionality.
Conditions required to exploit
Network access to the site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
