CVE-2025-12529: 
WordPress vulnerability analysis and mitigation

CVE-2025-12529 is an arbitrary file deletion vulnerability in the Cost Calculator Builder plugin for WordPress, caused by insufficient file path validation in the deleteOrdersFiles() function. It affects all versions of the plugin up to and including 3.6.3, and is exploitable only when both the free and Pro (Cost Calculator Builder Pro) versions are installed simultaneously. The vulnerability was published on December 2, 2025, and assigned a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-73 (External Control of File Name or Path): the deleteOrdersFiles() function does not adequately validate or sanitize file path inputs before performing file deletion operations. An unauthenticated attacker can inject arbitrary file paths into order records at submission time; when an administrator later deletes those orders, the malicious paths are passed to the deletion function. Deleting critical WordPress files such as wp-config.php can trigger WordPress's installation wizard on the next request, enabling an attacker to reconfigure the database and achieve remote code execution. Relevant source code is visible in the plugin's Trac repository at CCBOrderController.php lines 262 and 513 (Wordfence, Plugin Trac).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the WordPress server, with the most severe scenario being deletion of wp-config.php, which can lead to full remote code execution and complete site takeover. This results in high impacts to confidentiality, integrity, and availability — an attacker gaining RCE could exfiltrate sensitive data, install backdoors, pivot to other systems on the same host, or render the site unavailable. The attack requires administrator interaction (triggering the order deletion), but no authentication or privileges are needed from the attacker's side (Wordfence, Red Hat CVE).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.156%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific configuration (both free and Pro plugin versions installed) and depends on an administrator performing an order deletion action, which limits the attack surface.

1. Reconnaissance: Identify WordPress sites running both the Cost Calculator Builder (free) and Cost Calculator Builder Pro plugins, versions ≤ 3.6.3, using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Inject malicious file path: Submit a calculator order (no authentication required) and manipulate the file attachment field or order metadata to include an arbitrary file path such as ../../../../wp-config.php instead of a legitimate file reference.
3. Wait for administrator action: The injected path is stored in the order record. The attack is triggered when a site administrator deletes the order through the WordPress admin panel, causing deleteOrdersFiles() to process the attacker-controlled path.
4. File deletion occurs: The function deletes the file at the injected path (e.g., wp-config.php) without proper validation, removing the critical configuration file from the server.
5. Achieve remote code execution: With wp-config.php deleted, WordPress enters its installation/setup mode on the next page load. The attacker navigates to the site and runs the WordPress installer, pointing it to an attacker-controlled database, effectively gaining full administrative control and enabling arbitrary code execution (Wordfence, Plugin Trac).

• Logs: WordPress access logs showing POST requests to calculator order submission endpoints with unusual or encoded file path strings in parameters; access logs showing requests to wp-admin/install.php or the WordPress setup wizard from unexpected IPs shortly after order deletions.
• File System: Absence of wp-config.php in the WordPress root directory; unexpected new wp-config.php with altered database credentials; presence of new admin accounts or backdoor files (e.g., PHP webshells) in the WordPress installation.
• Database: New WordPress administrator accounts created via the setup wizard; database connection settings pointing to an external or unfamiliar host.
• Network: Outbound connections from the web server to unknown external IPs following the deletion event, potentially indicating post-exploitation activity such as reverse shell or data exfiltration.

Administrators should update the Cost Calculator Builder plugin to a version beyond 3.6.3 immediately, as the patch addresses the insufficient path validation in deleteOrdersFiles() (Wordfence). If an immediate update is not possible, consider temporarily deactivating the plugin or restricting administrator access to order deletion functionality. Additionally, implement file integrity monitoring on critical WordPress files (especially wp-config.php) to detect unauthorized deletions, and ensure wp-config.php has restrictive file system permissions to limit deletion by the web server process where possible.

The vulnerability was reported by Wordfence and received standard community distribution through security aggregators including RedPacket Security and CVE feed services shortly after disclosure on December 2, 2025. Social media posts on Mastodon and Bluesky from security community accounts noted the vulnerability's potential for RCE via file deletion. No major vendor statements beyond the Wordfence advisory or significant independent researcher commentary have been identified (Red Hat CVE).