CVE-2019-25295CWE-22

WP Cost Estimation < 9.660 - Upload Directory Traversal

Medium · published January 8, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00614 · 48.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-08T01:50Z
EPSS history
Timeline
  • 08 JAN 01:50Z
    WP Cost Estimation < 9.660 - Upload Directory Traversal
    cvelistv5