CVE-2019-25296

🗓️ 08 Jan 2026 02:21:17Reported by WordfenceType

WordPress plugin vulnerability allows unauthenticated file upload and deletion due to missing file validation in versions up to nine six four two.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2019-25296	8 Jan 202605:59	–	circl
CNNVD	WordPress plugin WP Cost Estimation 安全漏洞	8 Jan 202600:00	–	cnnvd
Cvelist	CVE-2019-25296 WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete	8 Jan 202602:21	–	cvelist
EUVD	EUVD-2026-1596	8 Jan 202602:21	–	euvd
NVD	CVE-2019-25296	8 Jan 202603:15	–	nvd
Positive Technologies	PT-2026-1685	8 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2019-25296	9 Jan 202608:38	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2019-25296	13 Feb 201900:00	–	vulncheck_kev
Vulnrichment	CVE-2019-25296 WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete	8 Jan 202602:21	–	vulnrichment

Vulners

Node

loopus wp_cost_estimation_&_payment_forms_builderRange<9.644wordpress

[
  {
    "vendor": "loopus",
    "product": "WP Cost Estimation & Payment Forms Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "9.644",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ae50aa5d-95e3-4650-9dbf-118b4ba3abda
zdnet	www.zdnet.com/article/another-wordpress-commercial-plugin-gets-exploited-in-the-wild/
wpscan	www.wpscan.com/vulnerability/9219
acunetix	www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-cost-estimation-payment-forms-builder-multiple-vulnerabilities-9-642/
wordfence	www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/

15 Apr 2026 00:35Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

EPSS0.00366

SSVC

CWE-434