CVE-2025-12529: Cost Calculator Builder WordPress RCE Flaw

CVE-2025-12529 Overview

CVE-2025-12529 is an arbitrary file deletion vulnerability affecting the Cost Calculator Builder plugin for WordPress. The vulnerability exists due to insufficient file path validation in the deleteOrdersFiles() function, allowing unauthenticated attackers to inject arbitrary file paths into orders that are subsequently deleted by administrators. This can lead to remote code execution when critical files such as wp-config.php are deleted.

Critical Impact

Unauthenticated attackers can achieve remote code execution by manipulating file deletion operations to remove critical WordPress configuration files, potentially compromising the entire WordPress installation.

Affected Products

• Cost Calculator Builder plugin for WordPress (versions up to and including 3.6.3)
• Cost Calculator Builder Pro (required to be installed alongside the free version for exploitation)
• WordPress sites running affected plugin combinations

Discovery Timeline

• 2025-12-02 - CVE-2025-12529 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12529

Vulnerability Analysis

This vulnerability is classified as CWE-73 (External Control of File Name or Path), which occurs when the application allows user-controlled input to influence file system operations without proper validation. In the context of the Cost Calculator Builder plugin, the deleteOrdersFiles() function fails to adequately sanitize file paths before performing deletion operations.

The attack requires a two-stage exploitation approach. First, an unauthenticated attacker must inject a malicious file path into an order record. When an administrator later deletes that order through the WordPress admin interface, the injected path is processed by the vulnerable function, resulting in the deletion of arbitrary files on the server.

Successful exploitation can lead to devastating consequences, including the deletion of wp-config.php, which contains database credentials and security keys. When this file is deleted, WordPress enters a setup state, potentially allowing attackers to reconfigure the installation and achieve full remote code execution.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and path sanitization in the deleteOrdersFiles() function within the CCBOrderController.php file. The function processes file paths associated with orders without verifying that the paths are confined to expected directories or validating against path traversal sequences.

The vulnerable code can be reviewed at CCBOrderController.php line 262 and line 513 in the plugin source code.

Attack Vector

The attack is network-based and can be initiated by unauthenticated attackers. The exploitation flow involves:

1. An attacker crafts a malicious order submission containing path traversal sequences pointing to critical files like ../../../wp-config.php
2. The malicious file path is stored in the order metadata without sanitization
3. When an administrator deletes the order through the WordPress admin panel, the deleteOrdersFiles() function processes the stored paths
4. The function deletes the files at the injected paths, including any critical configuration files

The vulnerability requires user interaction from an administrator to trigger the actual file deletion, as they must perform the order deletion action. The exploitation is dependent on having both the free and Pro versions of the Cost Calculator Builder plugin installed.

Detection Methods for CVE-2025-12529

Indicators of Compromise

• Unexpected deletion of wp-config.php or other critical WordPress files
• WordPress site reverting to installation/setup mode unexpectedly
• Order records containing suspicious path traversal patterns (e.g., ../, ..\\)
• Anomalous file system operations logged around order deletion events

Detection Strategies

• Monitor WordPress file integrity, particularly for wp-config.php and core files
• Implement web application firewall rules to detect path traversal attempts in form submissions
• Review order data for suspicious file path patterns before processing
• Deploy endpoint detection and response (EDR) solutions to monitor file deletion operations on web servers

Monitoring Recommendations

• Enable detailed logging for WordPress admin actions, especially order management operations
• Configure file integrity monitoring (FIM) for critical WordPress directories
• Set up alerts for unexpected modifications or deletions in the WordPress root directory
• Monitor web server logs for unusual POST requests to Cost Calculator Builder endpoints

How to Mitigate CVE-2025-12529

Immediate Actions Required

• Update the Cost Calculator Builder plugin to a version newer than 3.6.3 immediately
• If updates are not available, consider temporarily disabling the plugin until a patch is released
• Review and backup all order records before performing any deletion operations
• Implement file integrity monitoring on critical WordPress files

Patch Information

Users should update the Cost Calculator Builder plugin to the latest available version that addresses this vulnerability. Check the official WordPress plugin repository for updated versions. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Implement server-level file protection to prevent deletion of wp-config.php and other critical files
• Use a web application firewall (WAF) to filter requests containing path traversal patterns
• Restrict administrator access and implement additional authentication for order management operations
• Consider removing the Cost Calculator Builder Pro plugin temporarily if the free version functionality is sufficient

# Configuration example - Protect wp-config.php via .htaccess
<Files wp-config.php>
    order allow,deny
    deny from all
</Files>

# Alternative: Set immutable attribute on critical files (Linux)
# sudo chattr +i /var/www/html/wp-config.php