Description
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| loopus | WP Cost Estimation & Payment Forms Builder | < 9.660 | 9.660 |