CVE-2019-25295

WP Cost Estimation < 9.660 - Upload Directory Traversal

2019-02-14 00:00
Mikey Veenstra

Strategic Overview

Status
Patched in 9.660
Affected Plugin
WP Cost Estimation & Payment Forms Builder
Affected Version
< 9.660
CVSS
6.5Medium
Weakness type
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE
CVE-2019-25295
View all WP Cost Estimation & Payment Forms Builder vulnerabilities

At a glance

CVE-2019-25295 is a medium-severity Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the WP Cost Estimation & Payment Forms Builder WordPress plugin, affecting versions < 9.660. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 9.660; sites on affected versions should update now. Disclosed February 2019, reported by Mikey Veenstra.

Vulnerability Overview

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Reaching this weakness in WP Cost Estimation & Payment Forms Builder < 9.660 takes a caller who can reach the endpoint. Path traversal happens when user-controlled text is used to build a filesystem path without being constrained to an intended directory, so sequences like ../ walk the resolved path somewhere else.

Depending on the operation, it means reading files outside the intended folder — wp-config.php being the usual target — or writing to and deleting paths the web server can touch. For WP Cost Estimation & Payment Forms Builder the fix is 9.660: builds < 9.660 are affected, anything from 9.660 onward is not.

Remediation

Update to version 9.660, or a newer patched version

How does WordSec protect against this?

The attempt arrives as an ordinary request to WP Cost Estimation & Payment Forms Builder: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: WP Cost Estimation & Payment Forms Builder 9.660 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2019-25295https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78https://nvd.nist.gov/vuln/detail/CVE-2019-25295

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C