What the vulnerability does
01Description
The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.
Explanation of Vulnerability in Simple Terms
02Summary
Cost Calculator Builder versions 3.6.3 and earlier contain a vulnerability that allows attackers to read sensitive data, modify site content, or disrupt service. The attack requires a victim to visit a malicious link or page. No special privileges are needed to exploit this flaw, making it a significant risk for any site running the affected plugin.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or cause the site to become unavailable.
Potential impact on your site
04Site Impact
Attackers can steal data, deface your site, or take it offline without needing a user account.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
December 2, 2025
CVE published
April 8, 2026
Record updated
