Critical · published January 8, 2026
🚨 An unauthenticated attacker can upload any file they want! This chilling vulnerability in the WP Cost Estimation plugin for WordPress could lead to remote code execution and file deletion. 🔥 Think of this as an open garage door at a busy workshop — anyone can just stroll in, drop off whatever they like, and even take something away! Missing file type validation is like trusting anyone who walks through that door without checking their credentials. If exploited, an attacker could upload malicious scripts, allowing them to take control of the server and perform devastating actions. They could even delete critical files, like your database configuration, leaving your website vulnerable and functionality at risk. This is an absolute nightmare for any site owner!
Think of this as an open garage door at a busy workshop — anyone can just stroll in, drop off whatever they like, and even take something away! Missing file type validation is like trusting anyone who walks through that door without checking their credentials. The vulnerability arises from the WP Cost Estimation plugin's failure to validate file types during the lfb_upload_form and lfb_removeFile AJAX actions, allowing arbitrary file uploads and deletions by unauthenticated users.
If exploited, an attacker could upload malicious scripts, allowing them to take control of the server and perform devastating actions. They could even delete critical files, like your database configuration, leaving your website vulnerable and functionality at risk. This is an absolute nightmare for any site owner! Update the WP Cost Estimation plugin to version 9.643 or later immediately. Additionally, consider implementing stricter file type validation and access controls to prevent unauthorized uploads in the future. Regular backups are highly recommended to protect against data loss. You've got this! Follow these steps, and you’ll tighten your site’s security in no time! 🛡️