CVE-2025-12529 in Cost Calculator Builder Plugin
Summary
by MITRE • 12/02/2025
The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/02/2025
The vulnerability identified as CVE-2025-12529 affects the Cost Calculator Builder plugin for WordPress, representing a critical security flaw that stems from inadequate input validation within the deleteOrdersFiles() function. This weakness exists across all plugin versions up to and including 3.6.3, creating a persistent risk for WordPress installations that utilize this specific plugin combination. The vulnerability manifests when administrators perform routine cleanup operations on order files, as the system fails to properly validate file paths before executing deletion commands, allowing malicious actors to manipulate the deletion process through crafted input.
The technical exploitation of this vulnerability occurs through an arbitrary file deletion attack vector that leverages insufficient file path validation. When an administrator deletes order files through the plugin interface, the deleteOrdersFiles() function processes the file paths without adequate sanitization or validation checks. This allows unauthenticated attackers to inject malicious file paths that can target critical system files such as wp-config.php, which contains database credentials and other sensitive configuration data. The vulnerability requires both the free and Pro versions of the Cost Calculator Builder plugin to be installed simultaneously, indicating that the attack surface is specifically tied to this particular plugin combination rather than the WordPress core or other plugins.
The operational impact of CVE-2025-12529 extends beyond simple file deletion, as it can potentially lead to full system compromise through remote code execution. When attackers successfully delete critical system files, particularly wp-config.php, they can disrupt the WordPress installation's functionality and potentially gain additional access vectors. The vulnerability's requirement for both plugin versions to be present creates a specific attack scenario that security professionals must consider when assessing WordPress environments, as it narrows the exploitation conditions while still maintaining significant risk potential. This vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal attacks, and can be mapped to ATT&CK technique T1059.007 for remote code execution through web shell deployment.
Mitigation strategies for CVE-2025-12529 should focus on immediate plugin updates to versions that address the path validation flaw, as well as implementing additional security measures to monitor and restrict file deletion operations within WordPress environments. Organizations should ensure that both the free and Pro versions of the Cost Calculator Builder plugin are updated simultaneously to prevent exploitation, as the vulnerability requires both components to function. Security teams should also consider implementing file integrity monitoring solutions that can detect unauthorized file deletions, particularly targeting critical system files. Additionally, restricting administrative privileges and implementing proper access controls around plugin management functions can significantly reduce the attack surface for this vulnerability. The recommended approach includes disabling the plugin entirely if immediate updates are not feasible, while also conducting thorough security audits of WordPress installations to identify any potential exploitation attempts that may have occurred due to this vulnerability.