CVE-2025-26760: Calculator Builder File Inclusion Flaw

CVE-2025-26760 Overview

CVE-2025-26760 is a PHP Local File Inclusion (LFI) vulnerability in the Wow-Company Calculator Builder plugin for WordPress. The flaw affects all versions up to and including 1.6.2. It stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can leverage the issue to load arbitrary local files through the vulnerable plugin code path. Successful exploitation can expose sensitive configuration data, source code, and credentials. In certain environments, LFI can be chained with log poisoning or session file abuse to achieve code execution.

Critical Impact
Remote attackers can read arbitrary server-side files and potentially execute PHP code by abusing unvalidated include parameters in Calculator Builder versions up to 1.6.2.

Affected Products

Wow-Company Calculator Builder WordPress plugin
All versions from initial release through 1.6.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-02-22 - CVE-2025-26760 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-26760

Vulnerability Analysis

The Calculator Builder plugin includes PHP files based on input that is not adequately sanitized. An attacker who controls the filename parameter can direct the include or require statement to a path of their choosing. The vulnerability requires user interaction, which typically means an administrator or privileged user must click a crafted link or visit a malicious page. Attack complexity is high because the attacker must satisfy specific path or context constraints to reach the vulnerable code. Despite this, the impact spans confidentiality, integrity, and availability when exploitation succeeds.

Root Cause

The plugin constructs file paths for inclusion using attacker-influenced input without enforcing an allowlist or canonicalization. PHP's include and require functions resolve traversal sequences such as ../ and accept absolute paths. Without strict validation, the runtime loads files outside the intended directory. This pattern matches the canonical CWE-98 weakness for PHP file inclusion flaws.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the plugin. The attacker crafts a request or link containing a malicious file path parameter. When the request reaches the vulnerable handler, PHP includes the referenced file. Attackers commonly target files such as wp-config.php to extract database credentials. Where writable log files or session stores exist, attackers can poison them with PHP payloads and then include them to achieve remote code execution. The EPSS score of this vulnerability indicates a measurable likelihood of exploitation attempts against exposed instances.

No public proof-of-concept code is currently associated with this CVE. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-26760

Indicators of Compromise

HTTP requests to Calculator Builder endpoints containing traversal sequences such as ../, ..%2f, or URL-encoded null bytes
Access patterns referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP errors in web server logs referencing include() or require() failures from plugin directories
Outbound connections initiated by the web server process after suspicious inclusion attempts

Detection Strategies

Inspect web server access logs for requests targeting Calculator Builder query parameters with file path values
Deploy web application firewall (WAF) rules that block path traversal patterns directed at the plugin's URL paths
Monitor PHP error logs for failed to open stream warnings originating from plugin code
Baseline normal parameter values for plugin endpoints and alert on deviations containing filesystem syntax

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/calculator-builder/ to detect tampering
Forward WordPress and web server logs to a centralized analytics platform for correlation
Track authenticated administrator sessions for unusual navigation that could indicate clickbait-driven exploitation
Alert on read access to high-value files such as wp-config.php outside of normal application flows

How to Mitigate CVE-2025-26760

Immediate Actions Required

Identify all WordPress installations running Calculator Builder version 1.6.2 or earlier
Deactivate the plugin until a fixed version is installed if the site is publicly accessible
Rotate database credentials and WordPress secret keys if exploitation is suspected
Restrict administrator access and require multi-factor authentication to reduce user-interaction risk

Patch Information

No fixed version is referenced in the available advisory data at the time of writing. Site operators should consult the Patchstack Vulnerability Report for vendor patch status and apply any released update for versions later than 1.6.2 as soon as it is available.

Workarounds

Remove or disable the Calculator Builder plugin until a patched release is confirmed
Configure PHP with open_basedir restrictions to limit which directories include can reach
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to block remote inclusion vectors
Apply WAF virtual patching rules that reject requests containing traversal sequences to plugin URLs

bash

# Configuration example
# Restrict PHP file inclusion scope in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate calculator-builder
wp plugin delete calculator-builder