CVE-2025-12529

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12529", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T17:54:27.730Z", "datePublished": "2025-12-02T01:51:56.201Z", "dateUpdated": "2026-04-08T16:48:38.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:38.460Z"}, "affected": [{"vendor": "stylemix", "product": "Cost Calculator Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable."}], "title": "Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L513"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L262"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "JEONG YU CHAN"}], "timeline": [{"time": "2025-10-18T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-30T18:14:05.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-01T11:27:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-02T16:51:42.382546Z", "id": "CVE-2025-12529", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T16:55:33.155Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12529", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-02T16:51:42.382546Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T16:51:43.520Z"}}], "cna": {"title": "Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "JEONG YU CHAN"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "stylemix", "product": "Cost Calculator Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.6.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-18T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-10-30T18:14:05.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-01T11:27:40.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L513"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L262"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-02T01:51:56.201Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12529", "state": "PUBLISHED", "dateUpdated": "2025-12-02T16:55:33.155Z", "dateReserved": "2025-10-30T17:54:27.730Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-02T01:51:56.201Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cost Calculator Builder", "vendor": "stylemix", "versions": [{"lessThanOrEqual": "3.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable."}, {"lang": "es", "value": "El plugin Cost Calculator Builder para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos debido a una validaci\u00f3n insuficiente de la ruta de archivo en la funci\u00f3n deleteOrdersFiles() en todas las versiones hasta la 3.6.3, inclusive. Esto hace posible que atacantes no autenticados inyecten rutas de archivo arbitrarias en los pedidos que se eliminan, cuando un administrador los elimina. Esto puede llevar a la ejecuci\u00f3n remota de c\u00f3digo cuando se elimina el archivo correcto (como wp-config.php). Esta vulnerabilidad requiere que la versi\u00f3n Cost Calculator Builder Pro est\u00e9 instalada junto con la versi\u00f3n gratuita para que sea explotable."}], "id": "CVE-2025-12529", "lastModified": "2026-10-18T18:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12529", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-02T16:51:42.382546Z", "version": "2.0.3"}}]}, "published": "2025-12-02T03:16:15.657", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L262"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L513"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:54:10.244799+00:00", "value": {"mitigation_remediation": ["Update both the free and Pro versions of Cost Calculator Builder to the latest releases that address the arbitrary file deletion flaw.", "If an update cannot be applied, remove or disable the Pro add\u2011on that exposes the deleteOrdersFiles routine, or uninstall the plugin entirely until a validated fix is available.", "Configure your web application firewall or use a security plugin to block requests that contain directory traversal or file\u2011deletion patterns, and regularly monitor your site\u2019s file integrity for unexpected changes."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress installations running Cost Calculator Builder version 3.6.3 or earlier, with the Pro add\u2011on installed alongside the free plugin. Only environments that have both components are impacted, because the delete routine is exposed only when the Pro package is present.", "description_and_impact": "The Cost Calculator Builder plugin for WordPress contains a flaw that lets an attacker delete any file on the server when an administrator removes order records. The flaw arises from insufficient path validation in the deleteOrdersFiles routine, which can be triggered by unauthenticated HTTP requests. If a critical file\u2014such as the site\u2019s configuration\u2014is deleted, the attacker can achieve remote code execution by causing the application to load a controlled state or by dropping a malicious file into a writable directory.", "risk_and_exploitability": "The vulnerability is scored with a CVSS of 8.8, indicating high impact, but the EPSS score of less than 1\u202f% suggests that it is seldom exploited in the wild. It is not listed in the CISA KEV catalogue. The attack path is simple: an unauthenticated user can craft a request that invokes the deleteOrdersFiles action, causing path traversal and deletion of arbitrary files. Successful exploitation could lead to loss of critical configuration data and subsequent execution of arbitrary code by the web server."}}}}, "created": "2025-12-02T11:58:37.338400+00:00", "updated": "2026-04-21T18:00:11.731408+00:00", "vendors": ["stylemixthemes", "stylemixthemes$PRODUCT$cost_calculator_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}