Security readout for executives and security teams
Plain-English summary
A critical flaw in the WP Cost Estimation WordPress plugin lets unauthenticated attackers upload or delete server files on sites running versions up to 9.642. Successful abuse could lead to full site takeover, data exposure, or outage. Public reporting cited exploitation in the wild, so exposed websites should be prioritized urgently.
Executive priority
High priority for any organization running this plugin on public WordPress sites. The flaw can enable unauthenticated site compromise and destructive file deletion. Confirm exposure immediately, update or remove the plugin, and review affected sites for signs of compromise.
Technical view
CVE-2019-25296 is missing authorization and missing file type validation in the plugin’s lfb_upload_form and lfb_removeFile AJAX actions. The issue allows unauthenticated arbitrary file upload and file deletion. The CVSS 3.1 score is 9.8, with network access, low complexity, no privileges, and no user interaction required.
Likely exposure
Public WordPress sites using WP Cost Estimation & Payment Forms Builder versions up to and including 9.642 are the primary exposure. Internet-facing sites are higher risk because exploitation requires no authentication. The provided affected metadata is inconsistent, so validate installed plugin name and version directly.
Exploitation context
CISA KEV does not list this CVE in the provided data. However, ZDNet reporting cited exploitation in the wild, and Wordfence reported related patched vulnerabilities in 2019. Treat internet-facing vulnerable installations as likely targeted historically, even if current exploitation volume is not established here.
Researcher notes
The CVE description attributes impact to missing file type validation and missing authorization on two AJAX actions. Sources indicate arbitrary upload may enable remote code execution and deletion of sensitive files. Exact fixed version is not stated in the provided bundle, so avoid assuming remediation beyond moving past 9.642 using vendor-confirmed guidance.
Mitigation direction
- Identify all WordPress sites using WP Cost Estimation & Payment Forms Builder.
- Upgrade to a vendor-confirmed fixed version newer than 9.642, if available.
- If no safe update is available, disable or remove the plugin.
- Restrict site administration and file write access where operationally possible.
- Review vendor, Wordfence, and WPScan guidance before re-enabling the plugin.
Validation and detection
- Check installed plugin inventory and exact version across all WordPress sites.
- Confirm whether any instance runs version 9.642 or earlier.
- Review web logs for access to lfb_upload_form and lfb_removeFile actions.
- Inspect WordPress directories for unexpected new or deleted files.
- Verify backups and restore capability for affected sites.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25296 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ae50aa5d-95e3-4650-9dbf-118b4ba3abda?source=cveCVE reference
- https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/CVE reference
- https://www.zdnet.com/article/another-wordpress-commercial-plugin-gets-exploited-in-the-wild/CVE reference
- https://wpscan.com/vulnerability/9219CVE reference
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-cost-estimation-payment-forms-builder-multiple-vulnerabilities-9-642/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.