CVE-2019-25296: WP Cost Estimation Plugin RCE Vulnerability

CVE-2019-25296 Overview

The WP Cost Estimation plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to upload and delete arbitrary files on affected WordPress installations. The flaw exists due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to and including 9.642. This security weakness enables attackers to upload malicious files such as PHP web shells, potentially leading to complete server compromise through remote code execution. Additionally, attackers can delete critical configuration files including database configuration files, which can be leveraged to upload their own database configurations and gain unauthorized access to the WordPress installation.

Critical Impact

Unauthenticated attackers can achieve remote code execution by uploading malicious files and can manipulate server configurations by deleting and replacing database files, leading to complete site takeover.

Affected Products

• WP Cost Estimation & Payment Forms Builder plugin for WordPress versions up to and including 9.642

Discovery Timeline

• January 8, 2026 - CVE-2019-25296 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2019-25296

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The WP Cost Estimation plugin exposes two AJAX endpoints—lfb_upload_form and lfb_removeFile—that fail to implement proper file type validation and access controls. Because these endpoints are accessible to unauthenticated users and do not verify the file extensions or MIME types of uploaded content, attackers can upload executable PHP files directly to the web server. The absence of authentication requirements means any remote attacker can exploit this vulnerability without needing valid WordPress credentials.

The file deletion functionality is equally dangerous, as it allows attackers to remove critical system files including wp-config.php, which contains database credentials and security keys. Once deleted, attackers can upload replacement configuration files pointing to attacker-controlled databases, enabling complete hijacking of the WordPress installation.

Root Cause

The root cause of this vulnerability is insufficient input validation in the plugin's AJAX file handling functions. The lfb_upload_form action accepts file uploads without checking file extensions against a whitelist of safe file types, and without verifying MIME types. Similarly, the lfb_removeFile action does not properly restrict which files can be deleted or validate that the requesting user has authorization to perform file deletions. Both functions lack nonce verification and capability checks, making them accessible to any unauthenticated visitor.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can send specially crafted HTTP POST requests to the WordPress AJAX handler targeting the vulnerable endpoints. For file upload attacks, the attacker submits a PHP web shell disguised with an innocuous filename, which the plugin stores in a web-accessible directory. The attacker then accesses the uploaded shell directly via HTTP to execute arbitrary commands on the server. For file deletion attacks, the attacker sends requests to the lfb_removeFile endpoint specifying the path to sensitive files like wp-config.php.

The attack chain typically involves:

1. Sending a POST request to /wp-admin/admin-ajax.php with action=lfb_upload_form and a malicious PHP payload
2. Identifying the upload directory and accessing the uploaded web shell
3. Executing arbitrary system commands through the web shell to establish persistence

Detection Methods for CVE-2019-25296

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories, particularly in /wp-content/uploads/ or plugin-specific upload folders
• Web server logs showing POST requests to admin-ajax.php with action=lfb_upload_form from external IP addresses
• Missing or modified wp-config.php or other critical WordPress configuration files
• Suspicious outbound network connections from the web server indicating command and control communication

Detection Strategies

• Monitor WordPress AJAX endpoints for requests containing lfb_upload_form or lfb_removeFile actions, especially from unauthenticated sessions
• Implement file integrity monitoring on WordPress core files and critical plugin directories to detect unauthorized modifications
• Configure web application firewall (WAF) rules to inspect and block file uploads containing PHP or executable content to vulnerable endpoints
• Review web server access logs for patterns indicating automated exploitation attempts against the WP Cost Estimation plugin

Monitoring Recommendations

• Enable detailed logging of all WordPress AJAX requests and correlate with authentication state to identify unauthenticated access to sensitive endpoints
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process execution originating from web server processes
• Implement real-time alerting for new PHP file creation in upload directories outside of normal administrative activity windows

How to Mitigate CVE-2019-25296

Immediate Actions Required

• Update the WP Cost Estimation plugin to a version newer than 9.642 that includes the security patch
• If an update is not immediately available, deactivate the WP Cost Estimation plugin until a patched version can be installed
• Audit WordPress upload directories for any suspicious PHP files and remove unauthorized content
• Review web server logs for evidence of exploitation and assess whether the site may have been compromised

Patch Information

The vulnerability was patched by the plugin vendor in versions after 9.642. Security researchers at Wordfence documented the vulnerability and patch details in their Plugin Patch Analysis. Users should update to the latest available version through the WordPress plugin repository or CodeCanyon marketplace where the plugin is distributed. Additional vulnerability details are available through the Wordfence Vulnerability Threat Intel database.

Workarounds

• Temporarily disable the WP Cost Estimation plugin if updating is not immediately possible
• Implement web application firewall rules to block unauthenticated requests to the lfb_upload_form and lfb_removeFile AJAX actions
• Restrict file upload permissions in the web server configuration to prevent PHP execution in upload directories using .htaccess rules or nginx configuration directives
• Use WordPress security plugins to add additional authentication requirements to AJAX endpoints

# Apache .htaccess configuration to prevent PHP execution in uploads
# Add this to wp-content/uploads/.htaccess
<Files "*.php">
    Require all denied
</Files>

# Alternative method using handler removal
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps
RemoveType .php .phtml .php3 .php4 .php5 .php7 .phps