CVE-2019-25295mediumCWE-22

WP Cost Estimation < 9.660 - Upload Directory Traversal

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.5%

probabilidad de explotación

0.5%top 58% de las CVE

explotación observada

noninguna fuente lo reporta

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Productos afectados

loopus · WP Cost Estimation & Payment Forms Builder

Referencias

https://codecanyon.net/item/wp-cost-estimation-payment-forms-builder/7818230 https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78?source=cve